Add maintainer docs

Author: Ekin-Kahraman

CONTRIBUTING.md

@@ -0,0 +1,30 @@
+# Contributing
+
+Contributions are welcome when they improve reproducibility, biological annotation, testing, or figure quality.
+
+## Development setup
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+pip install -e ".[dev]"
+pytest -v
+python run_pipeline.py
+python scripts/validate_outputs.py
+```
+
+## Pull request checklist
+
+- `pytest -v` passes.
+- `ruff check` passes for changed Python files.
+- `python scripts/validate_outputs.py` passes after any pipeline-output change.
+- Changed figures are regenerated intentionally.
+- Annotation changes document which marker genes or scoring rules changed.
+
+## Scientific correctness
+
+Cluster labels and trajectory claims should be evidence-backed. If you change cell-type markers, Leiden resolution selection, QC thresholds, or pseudotime rooting, include the effect on cell counts and key figures.
+
+## Licence
+
+By contributing, you agree that your contributions are licensed under the MIT licence.

SECURITY.md

@@ -0,0 +1,24 @@
+# Security policy
+
+## Supported versions
+
+Security and correctness fixes are made on the default branch and latest tagged release.
+
+## Reporting a vulnerability
+
+This repository processes AnnData files, CSV files, and generated figures. If you find a vulnerability such as unsafe path handling, dependency supply-chain risk, or malformed input causing unintended writes, do not open a public issue.
+
+Email: evk23umu@uea.ac.uk
+Subject: `single-cell-rnaseq security: <short description>`
+
+Please include:
+- Reproduction steps
+- Python version and operating system
+- Input format used
+- Expected impact
+
+I aim to respond within 7 days.
+
+## Data handling
+
+Do not attach private single-cell datasets or patient metadata to public issues. Use PBMC 3k, synthetic AnnData files, or redacted examples.