community: add security and contribution health files

[dgenio]

Progresses #144.

What changed

Adds the community-health surfaces that matter most for a security-sensitive OSS library:

• SECURITY.md
  • private GitHub Security Advisory reporting route for vulnerabilities;
  • supported-version policy;
  • requested reproducer/evidence fields;
  • response expectations without pretending there is a staffed SLA;
  • explicit vulnerability scope + security-contract non-goals.
• CODE_OF_CONDUCT.md
  • concise project conduct expectations;
  • explicitly keeps conduct reporting separate from Security Advisories;
  • uses GitHub platform reporting for sensitive harassment/abuse concerns until a dedicated private project contact exists;
  • transparently states that the repo does not currently publish a dedicated private conduct mailbox.
• structured GitHub issue forms for bugs and feature proposals;
  • bug form diverts vulnerabilities to the private security channel;
  • proposal form requires user/problem evidence and acknowledges the gate-driven roadmap.
• issue-template config with private security/reporting + Security Contract links.
• security-aware pull-request template requiring compatibility/migration thinking, fail-closed tests and exact protocol/version evidence.

I also curated existing open issues #215, #220 and #186 with the repo's existing good-first-ai-issue label rather than inventing trivial contribution work.

Why

A security library should not ask reporters to disclose vulnerabilities publicly, and an adoption-focused OSS repo should help contributors distinguish actionable problems from speculative platform expansion.

Deliberate limitations

• This does not enable GitHub Discussions because repository-settings mutation is not exposed by the connected GitHub tool.
• It uses the existing good-first-ai-issue label because that label already exists; no new label-management surface is assumed.
• No fake private conduct channel is invented; GitHub platform reporting is documented until a dedicated project contact exists.
• SECURITY.md links docs/versioning.md, so merge this after the stability-policy PR docs: define the pre-1.0 stability and deprecation contract #282.

Validation

Repository metadata/docs only; no runtime code. CI should still validate repository formatting/link assumptions where configured.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds community health and security reporting surfaces for a security-sensitive OSS repo, including private vulnerability reporting guidance and structured contribution templates.

Changes:

• Added SECURITY.md and CODE_OF_CONDUCT.md with reporting guidance and project expectations.
• Added GitHub issue forms (bug + feature) and issue-template config with security contact links.
• Added a security-aware pull request template emphasizing contract/compatibility/test expectations.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
SECURITY.md	Defines supported versions, private vulnerability reporting flow, scope/non-goals, and response expectations
CODE_OF_CONDUCT.md	Establishes conduct expectations, scope, and reporting/enforcement approach
.github/pull_request_template.md	Adds PR checklist focused on security contract impact, compatibility, and validation
.github/ISSUE_TEMPLATE/feature_request.yml	Introduces structured feature proposal intake emphasizing evidence and scope
.github/ISSUE_TEMPLATE/bug_report.yml	Introduces structured bug intake and diverts suspected vulnerabilities to private reporting
.github/ISSUE_TEMPLATE/config.yml	Disables blank issues and adds contact links for private security reporting + contract reading

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.