From 872da85f2ea170d8b08d144422b11ea073316799 Mon Sep 17 00:00:00 2001
From: drjones <drjones@noreply.localhost>
Date: Wed, 20 May 2026 17:19:20 -0700
Subject: [PATCH] Add stewardship readiness asset: docs/SECURITY_REVIEW.md

---
 docs/SECURITY_REVIEW.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 docs/SECURITY_REVIEW.md

diff --git a/docs/SECURITY_REVIEW.md b/docs/SECURITY_REVIEW.md
new file mode 100644
index 0000000..2d56a0d
--- /dev/null
+++ b/docs/SECURITY_REVIEW.md
@@ -0,0 +1,14 @@
+# Security Review
+<!-- stewardship-standard: security-review-v1 -->
+
+## Required Checks
+
+- [ ] No credentials, tokens, cookies, API keys, private keys, or session files.
+- [ ] No private user data, dumps, card data, logs, or captures that should not be stored.
+- [ ] No copied dependency trees where package managers or SDK installers should be used instead.
+- [ ] No unexplained binaries in source history.
+- [ ] Risky behavior is documented and scoped to authorized lab use.
+
+## Release Gate
+
+A release is blocked until the checklist is complete or a maintainer explicitly records why the item does not apply.