Add SECURITY.md, PR and issue templates with private vuln reporting

Author: igorbenav

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,31 @@
+---
+name: Bug report
+about: Report a bug in crudauth
+title: ''
+labels: bug
+assignees: ''
+---
+
+**Describe the bug**
+A clear and concise description of what's wrong.
+
+**Reproduce**
+A minimal, self-contained example.
+
+```python
+# your code here
+```
+
+**Expected vs actual**
+What you expected to happen, and what actually happened (include the full error/traceback).
+
+**Environment**
+- crudauth version:
+- Python version:
+- FastAPI / SQLAlchemy / Pydantic versions:
+- Transport(s) and backend (e.g. session + bearer, memory or redis):
+
+**Additional context**
+Anything else that helps.
+
+> Found a security vulnerability? Do not file it here. See [SECURITY.md](../../SECURITY.md).

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/benavlabs/crudauth/security/advisories/new
+    about: Report privately via a GitHub Security Advisory, or email igor@benav.io. Do not open a public issue.
+  - name: Questions and discussion (Discord)
+    url: https://discord.com/invite/TEmPs22gqB
+    about: Ask questions and chat with the community.
+  - name: Documentation
+    url: https://benavlabs.github.io/crudauth
+    about: Read the docs before filing an issue.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,19 @@
+---
+name: Feature request
+about: Suggest an idea for crudauth
+title: ''
+labels: enhancement
+assignees: ''
+---
+
+**Problem**
+What are you trying to do that's hard or impossible today?
+
+**Proposed solution**
+What you'd like to happen.
+
+**Alternatives considered**
+Other approaches you've thought about, and why they fall short.
+
+**Additional context**
+Anything else, including how it fits crudauth's transport-agnostic model.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,22 @@
+## Description
+
+What does this PR do, and why?
+
+## Changes
+
+- 
+
+Link any related issues or PRs.
+
+## Checklist
+
+- [ ] `uv run ruff check crudauth tests` passes
+- [ ] `uv run mypy crudauth tests --config-file pyproject.toml` passes
+- [ ] `uv run pytest` passes
+- [ ] Added or updated tests for the change (if applicable)
+- [ ] Updated the docs if behavior changed (if applicable)
+- [ ] Kept imports pointing inward per [crudauth/ARCHITECTURE.md](../crudauth/ARCHITECTURE.md)
+
+## Notes
+
+Anything reviewers should know.

SECURITY.md

@@ -0,0 +1,47 @@
+# Security Policy
+
+## Supported versions
+
+crudauth is pre-1.0. During this phase only the latest release receives security fixes.
+Always run the latest version.
+
+| Version        | Supported     |
+| -------------- | ------------- |
+| Latest release | Yes           |
+| Older releases | No            |
+
+## Reporting a vulnerability
+
+Please report security issues privately. Do not open a public issue for a vulnerability.
+
+Use either channel:
+
+- Email: **igor@benav.io**
+- GitHub Security Advisory: https://github.com/benavlabs/crudauth/security/advisories/new
+
+Include whatever you have: a description, steps to reproduce, the impact, the affected
+version, and a suggested fix if you have one.
+
+## What to expect
+
+- Acknowledgment within 48 hours.
+- A status update within a week.
+- A fix timeline based on severity, critical issues first.
+- Coordinated disclosure once a fix is released, with credit if you want it.
+
+## Scope
+
+crudauth is an authentication library, so its security behavior is the product. Reports
+about the auth surface are especially welcome:
+
+- session and CSRF handling
+- bearer-token signing, scope handling, and revocation
+- login lockout and rate limiting
+- OAuth `state` handling and redirect safety
+- password storage and verification
+- registration field gating (mass-assignment)
+- timing and user-enumeration properties of the login path
+
+Some properties are documented as irreducible by design (for example, a holder of a correct
+password can still infer that an account is disabled). If you are unsure whether something
+counts, report it anyway.