Add maintainer docs

Author: Ekin-Kahraman

CONTRIBUTING.md

@@ -0,0 +1,30 @@
+# Contributing
+
+Contributions are welcome when they improve reproducibility, statistical correctness, documentation, or output validation.
+
+## Development setup
+
+```bash
+Rscript 000_install_dependencies.R
+Rscript scripts/12_output_manifest.R
+Rscript -e 'testthat::test_dir("tests/testthat")'
+Rscript dev/lint.R
+```
+
+The full rebuild path is checked in CI. Run the narrow tests locally before opening a pull request.
+
+## Pull request checklist
+
+- Tests pass with `testthat`.
+- `Rscript dev/lint.R` reports no lints.
+- Changed analysis outputs are regenerated intentionally.
+- `results/tables/output_manifest.csv` is updated when tracked outputs change.
+- Any changed statistical threshold, design formula, contrast, or filtering rule is documented in the README.
+
+## Scientific correctness
+
+Do not change reported results silently. If a change affects differential-expression counts, enrichment results, or figures, include the before and after numbers in the pull request.
+
+## Licence
+
+By contributing, you agree that your contributions are licensed under the MIT licence.

SECURITY.md

@@ -0,0 +1,24 @@
+# Security policy
+
+## Supported versions
+
+Security and correctness fixes are made on the default branch and latest tagged release.
+
+## Reporting a vulnerability
+
+This repository processes public GEO data and local tabular files. If you find a vulnerability such as unsafe file handling, credential leakage, or a supply-chain issue in dependency restoration, do not open a public issue.
+
+Email: evk23umu@uea.ac.uk
+Subject: `bulk-rnaseq security: <short description>`
+
+Please include:
+- Reproduction steps
+- R version and operating system
+- Whether `renv` restore was used
+- Expected impact
+
+I aim to respond within 7 days.
+
+## Data handling
+
+Do not attach private patient metadata, raw clinical files, or access credentials to public issues. Use public accession IDs or redacted synthetic examples.