From 976a1fc0df81bf6f211cfcdcfbc9c1e7c326e718 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Mon, 31 Aug 2026 01:40:49 +0200
Subject: [PATCH] Add top-level security entry point

---
 SECURITY.md | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..d5b0be6
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,7 @@
+# Security policy
+
+ForgeFlow can interact with local Git repositories, Gitea, update metadata and controlled deployment targets. Security-sensitive behavior is documented in [`docs/SECURITY.md`](docs/SECURITY.md).
+
+Report vulnerabilities privately to the repository owner when disclosure could expose credentials, signing material, repository access details or deployment infrastructure.
+
+Never commit Gitea tokens, SSH private keys, release-signing private keys, deployment credentials or local repository state. The packaged signing public key is intentionally public; private signing material must remain outside Git.