chore(release): prepare v1.0.0

SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are applied on a best-effort basis to the latest development state on `main` and the latest published package version.
+
+Older releases may not receive fixes.
+
+## Reporting a Vulnerability
+
+Please do not report security vulnerabilities in public GitHub issues or pull requests.
+
+Instead, report them privately to [email protected]. If GitHub private vulnerability reporting is enabled for this repository, you may use the repository's "Report a vulnerability" flow instead.
+
+Please include:
+
+- A clear description of the issue
+- Affected version or commit, if known
+- Reproduction steps or a proof of concept
+- Impact assessment, if you have one
+- Suggested remediation, if available
+
+## What to Expect
+
+- We will review reports as quickly as possible.
+- We may ask follow-up questions to confirm impact and scope.
+- We will aim for coordinated disclosure and a fix before public discussion.
+- When appropriate, we will document the fix in a release note or security advisory.
+
+## Out of Scope
+
+The following are usually not treated as security vulnerabilities by themselves:
+
+- Requests for help with local environment setup
+- Reports that only affect unsupported or heavily modified environments
+- General dependency hygiene suggestions without a demonstrated impact on this project