Add a SECURITY.md and document keystore sync/security risks

[Kapusch]

Hi @Redth

This project provides advanced key management features (Android/iOS), including the ability to cloud sync keystores across machines (see README: "Cloud sync keystores across machines").

I noticed there is currently no SECURITY.md documentation explaining potential risks, required precautions, or recommendations around key management and cloud sync.

I'm thinking this could help comforting the developer to use it safely if we added such documentation. What do you think?

Suggestion

• Add a SECURITY.md file, that clarifies how cloud keystore sync works and what security measures are in place or recommended.
• Briefly describe risks of accidental key leaks, including if keys are accidentally injected/copied into Copilot or other AI tools.
• Suggest security best practices for users (for local use, for cloud sync, and for automation/CI environments), or clearly state limitations.

Thanks!

[Redth]

Thanks for the suggestion. I think a formal SECURITY.md is a bit premature for where this project is at right now. That file typically signals a formal vulnerability disclosure process with response SLAs, which isn't something I'm set up to maintain for a personal/community project at this stage.

We'll look at updating the docs around keystore sync and improving them as the feature matures.