From 0bbfbbad5126fa03c9aeeebf8726a4200da2a955 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Mon, 31 Aug 2026 01:40:41 +0200
Subject: [PATCH 1/3] Harden local secret and workspace ignores

---
 .gitignore | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.gitignore b/.gitignore
index 0ba1a3c..d2da572 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,9 +1,24 @@
 node_modules/
 dist/
 .DS_Store
+Thumbs.db
 *.log
 coverage/
 artifacts/
 playwright-report/
 .forgeflow/
 .playwright-mcp/
+.env
+.env.*
+!.env.example
+*.pfx
+*.p12
+*.key
+*.pem
+!build/update-signing-public.pem
+.codex/
+.claude/
+.agents/
+.dyad/
+.idea/
+.vs/

From 976a1fc0df81bf6f211cfcdcfbc9c1e7c326e718 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Mon, 31 Aug 2026 01:40:49 +0200
Subject: [PATCH 2/3] Add top-level security entry point

---
 SECURITY.md | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..d5b0be6
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,7 @@
+# Security policy
+
+ForgeFlow can interact with local Git repositories, Gitea, update metadata and controlled deployment targets. Security-sensitive behavior is documented in [`docs/SECURITY.md`](docs/SECURITY.md).
+
+Report vulnerabilities privately to the repository owner when disclosure could expose credentials, signing material, repository access details or deployment infrastructure.
+
+Never commit Gitea tokens, SSH private keys, release-signing private keys, deployment credentials or local repository state. The packaged signing public key is intentionally public; private signing material must remain outside Git.

From 6fd69a2cd846d583f53b18c69d3917a468964dc2 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Mon, 31 Aug 2026 01:40:57 +0200
Subject: [PATCH 3/3] Add contribution and release hygiene guidance

---
 CONTRIBUTING.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 CONTRIBUTING.md

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..98b5667
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,13 @@
+# Contributing
+
+ForgeFlow changes must preserve exact-commit provenance, update integrity and safe deployment boundaries.
+
+Before opening a pull request:
+
+- do not commit tokens, SSH credentials, signing private keys, deployment secrets or local repository state;
+- keep update manifests/checksums/signatures deterministic and reviewable;
+- add regression tests for repository synchronization, dirty-file handling, update and deployment changes;
+- keep real deployment targets configurable rather than embedding private infrastructure;
+- run `npm run quality` and the managed validation workflow where supported.
+
+Release metadata should distinguish an unreleased package version from the latest published Gitea Release; do not advance public release claims until the corresponding release exists.