Harden first-release validation and dependency hygiene

SECURITY.md

@@ -0,0 +1,19 @@
+# Security policy
+
+## Reporting vulnerabilities
+
+Do not report suspected vulnerabilities, exploit inputs, or sensitive logs in
+public issues or pull requests. The planned reporting channel is GitHub Private
+Vulnerability Reporting on the official public repository.
+
+That repository and reporting channel are not available yet. Public release is
+blocked until maintainers configure and test the private reporting channel and
+replace this paragraph with its actual link. No response-time commitment is
+currently offered. Do not assume that a public issue is a private channel.
+
+## Supported versions
+
+Version 0.1.0 is an unreleased candidate. There is no supported production
+release yet. Dependency scans and regression tests are release checks, not a
+guarantee that the validator is free of vulnerabilities. Validate suitability
+for your deployment before using its results for routing decisions.