chore: repo standards v1 (gitleaks CI, SECURITY.md fingerprint, LICENSE/README)

.github/workflows/ci.yml

@@ -0,0 +1,24 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    name: Secret scan (gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

LICENSE

@@ -1,4 +1,4 @@
-MIT Liicense
+MIT License
 
 Copyright (c) 2026 Jordan Newell
 

README.md

@@ -162,3 +162,11 @@ Dotfiles are the standard answer. Clone the repo, run the installer, done. The g
 ---
 
 MIT licensed. Fork, adapt, make your own.
+
+## Contributing
+
+Issues and PRs welcome. Fork, branch, open a PR against `main`.
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Email **security@jordannewell.com** with:
+
+- A description of the issue and its impact
+- Reproduction steps (a minimal example is ideal)
+- Affected version or commit
+
+**Do not open a public GitHub issue** for security reports.
+
+If you have a PGP key, encrypt your report. GPG fingerprint of the project's
+reporting key:
+
+```
+67567DC5E7C5353F85F2AF0DAC05D3F3E0EFA32A
+```
+
+## Response timeline
+
+- **Acknowledgment:** within 72 hours
+- **Initial assessment:** within 5 business days
+- **Fix or mitigation:** target 30 days for high-severity issues
+
+Please refrain from public disclosure until a fix has been published, to
+protect downstream users. Reporters will be credited in the release notes
+unless they prefer otherwise.
+
+## Scope
+
+Only vulnerabilities in this repository's code and published releases are in
+scope. Issues in third-party dependencies should be reported upstream, though
+a heads-up email is appreciated for anything actively exploited.