Harden first-release validation and dependency hygiene

2026-09-10 09:53:45 +08:00
parent 277cbca878
commit 591bed90a8
61 changed files with 1641 additions and 622 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -12,3 +12,7 @@ Documentation and code comments use English. Do not commit generated repository
 objects, keys, state, logs or build outputs. Keep third-party attribution intact.
 Submit only code you are entitled to contribute under the [project license](LICENSE)
 and identify externally sourced code and its license in the pull request.
+
+Use the [security policy](SECURITY.md) for suspected vulnerabilities, not public
+issues. Changes to Cargo.lock must update and check dependency notices using
+the [dependency maintenance workflow](docs/dependencies.md).