From e62a1d8c1b5095ceb5f327bfd1812d736578edee Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Sun, 30 Aug 2026 23:16:59 +0200
Subject: [PATCH 1/4] ci: use Gitea action mirrors on native runner

---
 .gitea/workflows/quality.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/quality.yml b/.gitea/workflows/quality.yml
index 709729d..4d84fc0 100644
--- a/.gitea/workflows/quality.yml
+++ b/.gitea/workflows/quality.yml
@@ -9,7 +9,7 @@ jobs:
   secret-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@v4
       - name: Secret scan
         shell: bash
         run: |
@@ -23,8 +23,8 @@ jobs:
     # Browser quality runs against the dedicated bounded Windows 11 VM runner.
     runs-on: windows-native
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: https://gitea.com/actions/checkout@v4
+      - uses: https://gitea.com/actions/setup-node@v4
         with:
           node-version: 22
           cache: npm
@@ -38,7 +38,7 @@ jobs:
       - run: npm run test:browser:ci
       - name: Preserve browser failure evidence
         if: failure()
-        uses: actions/upload-artifact@v3.2.2-node20
+        uses: https://gitea.com/actions/upload-artifact@v3.2.2-node20
         with:
           name: forgeflow-browser-failure-evidence
           path: artifacts/

From b454bafec3a623b45f2337636b71902b72c72fe8 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Sun, 30 Aug 2026 23:17:17 +0200
Subject: [PATCH 2/4] ci: avoid corrupt GitHub action cache on release runner

---
 .gitea/workflows/release.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 35f093c..78c7448 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -15,10 +15,10 @@ jobs:
   release:
     runs-on: windows-native
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@v4
         with:
           fetch-depth: 2
-      - uses: actions/setup-node@v4
+      - uses: https://gitea.com/actions/setup-node@v4
         with:
           node-version: 22
           cache: npm

From 060171d714f7f1a146e331881613b3f8ac32f9a1 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Sun, 30 Aug 2026 23:17:50 +0200
Subject: [PATCH 3/4] docs: align readme with ForgeFlow 0.10.15

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 4d7e99d..add773e 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 ForgeFlow is een Windows-desktopapp voor wie Git, Gitea en eigen Docker- of Unraid-servers gebruikt. Je ziet in één werkruimte wat lokaal gewijzigd is, wat op Gitea staat en welke exacte commit op de server draait. ForgeFlow begeleidt je daarna veilig door review, commit, push, deployment en verificatie.
 
-> Huidige release: **0.10.14** · [download de laatste Windows-release](https://gitea.itworx.tech/Jens/ForgeFlow/releases/latest)
+> Huidige release: **0.10.15** · [download de laatste Windows-release](https://gitea.itworx.tech/Jens/ForgeFlow/releases/latest)
 
 ![ForgeFlow release-overzicht](docs/screenshots/overview.png)
 

From b486285027217829b8bb9b60707cb4f82b2c3ead Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Sun, 30 Aug 2026 23:17:57 +0200
Subject: [PATCH 4/4] docs: add top-level security entry point

---
 SECURITY.md | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..40a8a88
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,9 @@
+# Security Policy
+
+ForgeFlow's detailed security model is documented in [`docs/SECURITY.md`](docs/SECURITY.md).
+
+Report suspected vulnerabilities privately to the repository owner. Do not publish Gitea tokens, SSH credentials, update-signing material, private server addresses, support bundles containing sensitive data or other operational secrets in a public issue.
+
+For a useful report, include the affected ForgeFlow version/commit, component, minimal reproduction steps, expected and observed behaviour and security impact. Use sanitized or synthetic repository/server data whenever possible.
+
+The current release model requires exact-commit verification, origin-constrained credential use, signed update manifests, redacted diagnostics and bounded deployment adapters. Changes must not silently weaken those guarantees.