docs: add community standards (license, contributing, security, templates)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,48 @@
+name: Bug report
+description: Create a report to help us improve
+title: "[Bug] "
+labels: ["Bug"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the bug
+      description: A clear and concise description of what the bug is.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: To Reproduce
+      description: Steps to reproduce the behavior.
+      placeholder: |
+        1. Go to '...'
+        2. Click on '...'
+        3. Scroll down to '...'
+        4. See error
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: A clear and concise description of what you expected to happen.
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      description: If applicable, add screenshots to help explain your problem.
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, browser, and version (e.g. v1.0.0 or commit hash).
+      placeholder: |
+        OS: 
+        Browser: 
+        Version:
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,29 @@
+name: Feature request
+description: Suggest an idea for this project
+title: "[Feature] "
+labels: ["Feature"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Is your feature request related to a problem?
+      description: A clear and concise description of what the problem is.
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Describe the solution you'd like
+      description: A clear and concise description of what you want to happen.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Describe alternatives you've considered
+      description: Any alternative solutions or features you've considered.
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Add any other context or screenshots about the feature request here.

.github/pull_request_template.md

@@ -0,0 +1,31 @@
+## What does this PR do?
+
+<!-- A short description of what this PR changes and why. -->
+
+## Related issue
+
+<!-- Link to the issue this PR closes, e.g. Closes #123 or STY-XX -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Performance improvement
+- [ ] Documentation
+- [ ] Refactor / chore
+
+## Checklist
+
+- [ ] Code follows project coding standards (gofmt / prettier / eslint)
+- [ ] `go vet ./...` and `go test ./...` pass (if backend changed)
+- [ ] `npm run check` and `npm run lint` pass (if frontend changed)
+- [ ] Build passes (`go build ./...` / `npm run build`)
+- [ ] Backend/ and frontend/ changes are kept in separate PRs
+
+## Testing
+
+<!-- Describe how you tested your changes. -->
+
+## Screenshots (if applicable)
+
+<!-- Add screenshots to help explain your changes. -->

CONTRIBUTING.md

@@ -0,0 +1,100 @@
+# Contributing to Neuralwire
+
+Thanks for your interest in contributing to Neuralwire! We welcome
+contributions that improve the platform while keeping the curator model
+intact: AI assists, humans decide what gets published.
+
+Please read our [Code of Conduct](CODE_OF_CONDUCT.md) before participating.
+
+## Ways to Contribute
+
+- **Report bugs** — open an issue with clear steps to reproduce.
+- **Suggest features** — open an issue describing the problem you're solving.
+- **Fix / implement** — fork the repo, create a branch, open a pull request.
+
+## Development Setup
+
+### Prerequisites
+- Go 1.25+
+- Node.js 24+
+- npm
+
+### Backend
+```bash
+cd backend
+cp .env.example .env   # configure env (defaults work for local dev)
+go mod download
+go run ./cmd/server    # starts on :8080
+```
+
+### Frontend
+```bash
+cd frontend
+cp .env.example .env.local   # set PUBLIC_API_URL=http://localhost:8080/api
+npm install
+npm run dev                  # starts on :5173
+```
+
+## Branch & PR Workflow
+
+This repo uses a two-branch workflow with branch protection:
+
+```
+development (work freely, CI runs, no deploy)
+      │  push + open PR
+      ▼
+main (protected, CI must pass, deploys to production)
+```
+
+1. Create a feature branch from `development`.
+2. Commit and push. CI runs on every push.
+3. Open a **Pull Request** to `main`.
+4. CI must pass:
+   - `Build, vet & test` (backend)
+   - `Install, check, lint & build` (frontend)
+5. A maintainer reviews and merges.
+
+> `main` is protected: direct pushes are blocked and all commits must come
+> through PRs with green CI.
+
+## Coding Standards
+
+### Backend (Go)
+- Run `gofmt` before committing (`gofmt -l .` must output nothing).
+- Run `go vet ./...` and `go test ./...` locally.
+- Keep dependencies minimal; prefer the standard library.
+
+### Frontend (SvelteKit)
+- Run `npm run check` (svelte-check) and `npm run lint` (prettier + eslint).
+- Keep TypeScript types strict.
+- Do not modify `backend/` in frontend PRs and vice versa.
+
+## Commit Messages
+
+Write concise, descriptive commit messages that explain the *why*:
+
+```
+type(scope): short summary
+
+Body explaining context, especially non-obvious decisions.
+```
+
+Examples:
+- `feat(api): add admin image upload endpoint`
+- `fix(ui): article share buttons open correct share URLs`
+- `perf(db): add index on news(url)`
+- `docs: add contributing guide`
+
+## Project Structure
+
+```
+backend/    Go REST API + scheduler
+frontend/   SvelteKit app (adapter-static)
+.github/    CI workflows
+```
+
+See the root [README](README.md) for full details.
+
+## Questions?
+
+Open an issue or reach out via the contact in our [Security Policy](SECURITY.md).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 stysus
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -399,4 +399,7 @@ Tracked in Linear (project: NEURALWIRE):
 
 ## License
 
-© 2026 NEURALWIRE MEDIA. All rights reserved.
+MIT License — see [LICENSE](LICENSE).
+
+© 2026 NEURALWIRE MEDIA. All rights reserved for curated content; source code
+is licensed under MIT.

SECURITY.md

@@ -0,0 +1,44 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+We take security seriously. If you discover a security vulnerability in
+Neuralwire, please **do not** open a public issue. Instead, report it
+privately so we can fix it before it is disclosed.
+
+**Email:** stysus@proton.me
+
+Please include:
+- A description of the vulnerability.
+- Steps to reproduce (if possible).
+- Affected version / commit.
+- Any suggested fix (optional).
+
+We aim to acknowledge reports within 3 business days and will keep you
+updated on progress.
+
+## Scope
+
+In scope:
+- The Go backend (REST API, scheduler, auth, rate limiting).
+- The SvelteKit frontend (XSS, CSRF, client-side issues).
+- Deployment configuration (Docker, env handling).
+
+Out of scope:
+- Content of curated articles (copyright issues go through the DMCA page).
+- Third-party services (Railway, Cloudflare, GitHub) — report to their
+  respective programs.
+
+## Supported Versions
+
+The latest `main` branch is the supported version. Releases are tagged (e.g.
+`v1.0.0`); older releases are supported on a best-effort basis.
+
+## Security Features
+
+- Bearer-token admin auth with constant-time validation.
+- CSRF protection on admin mutations.
+- Rate limiting (login, views, global).
+- Security headers (CSP, X-Frame-Options, nosniff, HSTS via Cloudflare).
+- Production hardening: refuses to boot with default credentials.
+- `APP_ENV=production` guard in `cmd/server/main.go`.