[ancongui]

What and why

The repository is public, so people need to know how to report a vulnerability privately and how to propose a change.

Changes

• SECURITY.md: supported versions, GitHub private vulnerability reporting (now enabled on the repository), what happens after a report, what is in and out of scope, and how the repository is protected.
• CONTRIBUTING.md: issues first for larger changes, working on a clone without installing devkit, how to make a change, the checks a pull request must pass, commits and pull requests, and the Apache-2.0 inbound terms.
• README.md links both from Credits and license.
• docs/development.md: the release process now uses dev pr merge, dev release, and a check of the published archive, instead of raw commands the guard refuses.
• CHANGELOG.md [Unreleased]: both entries.

How to verify

• dev docs check is 0/0/0 across the repository (markdownlint, links, Vale, SVGs).
• Every command the guides name exists (bin/dev test prove, crew sync, stubs, ci --run).
• gh api repos/fireflysoftwaresolutions/devkit/private-vulnerability-reporting returns enabled: true, so the advisory link in SECURITY.md works.
• dev ci --run passed in full (evidence for tree 907012d).

Risk and rollback

• Documentation only; revert the merge to roll back. Private vulnerability reporting is a repository setting: turn it off in Settings › Security if needed.

Links

• Follows the 26.11.1 release (chore(release): 26.11.1 #2), which made devkit open source and the repository public.