Publish DevRunbook source

SECURITY.md

@@ -0,0 +1,25 @@
+# Security policy
+
+## Supported state
+
+DevRunbook is a self-hosted application and its deployment manifests, web
+service, worker, database schema, import boundaries and build-pack contracts are
+in scope. Until a stable release is tagged, security fixes target the latest
+commit on the canonical `main` branch. After stable releases begin, this section
+will list the supported version series explicitly.
+
+## Reporting a vulnerability
+
+Do not place credentials, tokens, private repository contents or exploit details
+in a public issue. Report vulnerabilities privately to
+[`security@itworx.tech`](mailto:security@itworx.tech). If email is unavailable,
+contact the operator of your deployment through its documented private channel.
+
+A useful report includes the affected contract or file, impact, minimal reproduction, preconditions and a redacted proof. Never include live secrets.
+
+## Security boundaries
+
+DevRunbook must not execute arbitrary repository commands, must treat imported
+content as untrusted data, must keep Gitea read-only and must enforce the
+controls in `docs/13-security-privacy-threat-model.md` and
+`docs/26-authentication-authorization.md`.