docs: add SECURITY.md

SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+## Scope
+
+This repository is maintained for authorized, lawful work only. Do not use code, firmware, payloads, scripts, or documentation from this project against systems, accounts, devices, networks, cards, readers, or services you do not own or do not have explicit permission to test.
+
+## Reporting
+
+Report security concerns privately to the maintainer. Do not open public issues containing live credentials, tokens, private captures, card data, target identifiers, exploit chains, or sensitive logs.
+
+## Secrets And Data
+
+- Do not commit `.env` files, API keys, Wi-Fi credentials, session cookies, private keys, dumps, captures, or personal data.
+- Firmware binaries and captured artifacts must include provenance notes and SHA256 hashes before release.
+- Generated dependency folders and build output belong outside Git unless there is a documented reason.
+
+## Maintainer Rule
+
+If a change increases misuse risk, narrows safety boundaries, or weakens provenance, it must be rejected or quarantined until documented.