Initial curated projectbrain source from 8a7b1e0651dbdab97d744cbd2e653ab3970ac6c5

SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Reporting vulnerabilities
+
+Report suspected vulnerabilities privately to the repository owner. Do not publish Gitea credentials, repository write tokens, project-private source material, execution/session packs containing sensitive data, operator credentials, private infrastructure details or exploit-sensitive evidence in a public issue.
+
+Include the affected release/commit, component, minimal reproduction conditions using synthetic project data where possible, expected and observed behaviour, impact, and whether the issue affects authentication, repository delivery, project isolation, approvals, MCP boundaries, archive/session-pack generation, webhook processing, audit history or deployment.
+
+## Security and publication boundaries
+
+ProjectBrain manages project context and governed repository delivery. Source material imported from private projects does not become public merely because ProjectBrain can index or package it. Session-pack exports must preserve their documented bounded scope and must not silently become repository backups.
+
+Repository writes, merges and other external effects must remain attributable, validated and policy-controlled. Never commit live `.env` files, service credentials, private project archives or unredacted operational data.