Establish private security reporting and review policy

CONTRIBUTING.md

@@ -0,0 +1,12 @@
+# Contributing
+
+Contributions are welcome when they are focused, testable, and safe to review.
+
+1. Create a branch from the current default branch.
+2. Make one coherent change and add regression coverage where applicable.
+3. Run the repository's documented tests and static checks.
+4. Open a pull request in English that explains the impact and validation.
+
+Do not include secrets, credentials, private infrastructure details, or customer
+data. Security-sensitive changes require independent review before merge. Report
+suspected vulnerabilities privately according to `SECURITY.md`.

SECURITY.md

@@ -0,0 +1,20 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes target the latest release on the default branch. Upgrade to the
+newest version before reporting a problem.
+
+## Private reporting
+
+Do not open a public issue for an undisclosed vulnerability. Use GitHub private
+vulnerability reporting:
+
+<https://github.com/vtino17/network-security-lab/security/advisories/new>
+
+Include the affected version or commit, reproduction steps, expected and actual
+behavior, and potential impact. Remove credentials, private keys, IP addresses,
+hostnames, and customer data.
+
+Maintainers will acknowledge the report, validate the finding, and coordinate a
+fix and disclosure timeline with the reporter.