security: add GitHub Actions build check + SECURITY.md policy

- Add CI workflow to prevent future build errors on PRs/pushes
- Document security headers and vulnerability reporting
- Ved Parkash Arya <vedprakasharya9973@gmail.com>

Author: agent

.github/workflows/build-check.yml

@@ -0,0 +1,20 @@
+name: Build Check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm run build
+      - run: npm run lint

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| main    | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities to **hello@snapforest.in**.
+
+We take all security issues seriously and will respond within 48 hours.
+
+## Security Measures Implemented
+
+- **Content Security Policy (CSP)** — Strict resource loading policies via `vercel.json`
+- **Strict-Transport-Security (HSTS)** — Enforced HTTPS with 2-year max-age
+- **X-Frame-Options: DENY** — Clickjacking protection
+- **X-Content-Type-Options: nosniff** — MIME sniffing protection
+- **Referrer-Policy** — Cross-origin referrer control
+- **Permissions-Policy** — Restricted browser API access
+- **COOP / COEP** — Cross-origin isolation policies
+- **Security Headers** — Comprehensive OWASP-aligned header configuration
+
+---
+
+**Snapforest by Ved Parkash Arya** — Security is not an afterthought.