docs: add SECURITY.md and pull-request template

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,29 @@
+<!--
+Thanks for contributing! A few notes before you submit:
+- Use a Conventional Commit style PR title (e.g. `fix:`, `feat:`, `docs:`, `chore:`).
+- Keep the description focused; delete sections that don't apply.
+-->
+
+## Summary
+
+<!-- What does this PR change, and why? One or two sentences is plenty. -->
+
+## Related issue
+
+<!-- Link the issue this closes, e.g. "Closes #123". Leave blank if none. -->
+Closes #
+
+## Type of change
+
+- [ ] Bug fix (`fix:`)
+- [ ] New feature (`feat:`)
+- [ ] Documentation (`docs:`)
+- [ ] Refactor / maintenance (`refactor:` / `chore:`)
+- [ ] Other (explain below)
+
+## Checklist
+
+- [ ] `tox` passes locally (tests, `ruff format --check`, `ruff check`, `mypy --strict`, `bandit`)
+- [ ] Tests added or updated for the change
+- [ ] Documentation updated where relevant
+- [ ] PR title follows [Conventional Commits](https://www.conventionalcommits.org/)

SECURITY.md

@@ -0,0 +1,48 @@
+# Security Policy
+
+> **Template note:** This file ships with the plugin template. If you create a
+> plugin from it, update the contact below to your own private channel (and
+> keep or remove this note as you see fit).
+
+## Supported Versions
+
+Security fixes are applied to the latest released version and the `main`
+branch. We do not backport fixes to older releases — please upgrade to the
+latest version before reporting.
+
+| Version        | Supported          |
+| -------------- | ------------------ |
+| Latest release | :white_check_mark: |
+| Older releases | :x:                |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues,
+pull requests, or discussions.** This keeps users protected while a fix is
+prepared.
+
+Instead, use one of these private channels:
+
+1. **GitHub Private Vulnerability Reporting** (preferred) — open the **Security**
+   tab of this repository and click **Report a vulnerability**. This keeps the
+   report, discussion, and coordinated disclosure in one place.
+2. **Email** — for plugins in the mloda organization, write to
+   **security@mloda.ai**. If you forked this template, use your own address.
+
+Please include as much of the following as you can:
+
+- The type of issue (e.g. injection, path traversal, deserialization,
+  dependency vulnerability).
+- The affected module or file path (`file.py:line` if known).
+- Step-by-step reproduction or a proof of concept.
+- The potential impact and any suggested mitigation.
+
+## What to Expect
+
+- We'll get in touch to acknowledge your report.
+- We'll assess the severity and keep you updated as we work toward a fix.
+- We're happy to credit you in the advisory once it's published, unless you
+  prefer to remain anonymous.
+
+We follow coordinated disclosure: we ask that you give us a reasonable window
+to release a fix before any public disclosure.