Add MIT license and finalize source-publication readiness

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Denis Kulman
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -6,17 +6,17 @@
 
   <p>
     <a href="https://github.com/KulmanD/Mx-Master-3-For-mac-lightweight-swiftBased/actions/workflows/test.yml"><img src="https://github.com/KulmanD/Mx-Master-3-For-mac-lightweight-swiftBased/actions/workflows/test.yml/badge.svg?branch=main" alt="Test status"></a>
-    <a href="https://github.com/KulmanD/Mx-Master-3-For-mac-lightweight-swiftBased/releases/latest"><img src="https://img.shields.io/github/v/release/KulmanD/Mx-Master-3-For-mac-lightweight-swiftBased?label=release" alt="Latest release"></a>
+    <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="MIT License"></a>
     <img src="https://img.shields.io/badge/macOS-12%2B-black?logo=apple" alt="macOS 12 or newer">
     <img src="https://img.shields.io/badge/Swift-5.9-F05138?logo=swift&logoColor=white" alt="Swift 5.9">
   </p>
 
   <p>
-    <a href="https://github.com/KulmanD/Mx-Master-3-For-mac-lightweight-swiftBased/releases/latest">Latest release</a>
-    &middot;
     <a href="#installation">Installation</a>
     &middot;
     <a href="config/README.md">Terminal and configuration guide</a>
+    &middot;
+    <a href="LICENSE">MIT License</a>
   </p>
 </div>
 
@@ -104,9 +104,9 @@ available when the defaults do not match another setup.
 ### Current distribution status
 
 An official Developer ID signed and notarized download is not available yet.
-The existing v0.3.0 app asset is an older, ad-hoc-signed Apple Silicon validation
-build and does not contain the final candidate. Until a new signed release is
-published, installing the current source is the recommended path.
+The historical v0.3.0 app asset is an older, ad-hoc-signed Apple Silicon
+validation build and does not contain the final candidate. Until a new signed
+release is published, installing the current source is the recommended path.
 
 ### Install the native app from source
 
@@ -292,18 +292,12 @@ especially when they include the mouse model, connection method, macOS version,
 button IDs, and read-only Diagnostics output. Run `swift test` and both debug and
 release builds before proposing source changes.
 
-Contribution terms are not finalized until the repository owner selects a
-license and adds `CONTRIBUTING.md`. Open an issue before investing in a large
-change.
+The project is available under the MIT License. Open an issue before investing
+in a large change.
 
 ## License
 
-No license has been selected yet. The repository must not be described as open
-source until the owner adds one. Making source visible on GitHub does not by
-itself grant permission to copy, modify, or redistribute it.
-
-The [publication-readiness report](docs/PUBLICATION_READINESS.md) compares MIT
-and Apache-2.0 and records the remaining owner decision.
+mx3-lite is available under the [MIT License](LICENSE).
 
 ## Trademark disclaimer
 

SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are made against the latest source on the `main` branch.
+
+| Version | Supported |
+| --- | --- |
+| Latest `main` source | Yes |
+| Historical v0.2.0 and v0.3.0 release assets | No |
+
+The historical release assets are validation artifacts, not current official
+application distributions.
+
+## Reporting a vulnerability
+
+Do not disclose a suspected security vulnerability in a public GitHub issue,
+discussion, or pull request.
+
+After GitHub private vulnerability reporting is enabled for this repository,
+use **Security > Advisories > Report a vulnerability** to send the report
+privately. Include the affected version or commit, reproduction steps, impact,
+and any suggested mitigation. If private reporting is not available, do not put
+vulnerability details in a public issue.
+
+Ordinary bugs without security impact belong in the normal GitHub issue
+tracker.