Prepare project for public release

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Supported versions
+
+Until tagged releases are published, only the current default branch receives
+security fixes. Supported release versions will be listed here once releases
+begin.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a suspected vulnerability. Prefer GitHub's
+private vulnerability reporting from the repository's Security tab. Include
+the affected commit or version, impact, reproduction steps, and any suggested
+mitigation.
+
+If private reporting is not enabled, ask the maintainer for a private reporting
+channel without disclosing vulnerability details publicly.
+
+Do not include real SNMP credentials, `.env`, `config.ini`, `state.json`,
+controller addresses, AP names, or unredacted logs. Reports will be
+acknowledged and updated on a best-effort basis; please allow time for a fix
+before public disclosure.