Repo health: missing SECURITY.md / CoC / issue + PR templates, stale `netlify-build` script, no .nvmrc

[sidgaikwad]

A grab-bag of small repo-level gaps, grouped because each is a few lines on its own.

Missing community health files

.github/ contains only dependabot.yml and workflows/. For a published, MIT-licensed package accepting outside PRs (several are already merged), the standard set is missing:

• SECURITY.md — no documented way to report a vulnerability privately. Worth pairing with GitHub's private vulnerability reporting.
• CODE_OF_CONDUCT.md
• .github/ISSUE_TEMPLATE/ — a bug template asking for package version, React version, browser and a repro would save a round trip on most reports. A config.yml could also point AI-Assistant/account questions at Unlayer support rather than here.
• .github/PULL_REQUEST_TEMPLATE.md — CONTRIBUTING.md has real rules (Conventional Commits, exact-pinned deps, no console.log/console.debug) that a checklist would surface at the moment they matter.

Stale netlify-build script

https://github.com/unlayer/react-image-editor/blob/628b507/package.json#L40

"netlify-build": "cd demo && npm install && npm run build"

There's no netlify.toml in the repo, and the README points the live demo at react-image-editor-example.vercel.app. The demo appears to be on Vercel now, leaving this script as a dead reference to a previous host. Either remove it or, if Netlify is still a deploy target, commit the config that uses it.

No .nvmrc / .editorconfig

• .nvmrc (or .node-version) would let nvm use pick the right Node without cross-referencing CI.
• .editorconfig would carry the Prettier basics (UTF-8, LF, final newline) into editors that don't run Prettier on save — cheap insurance for the lint job.