chore: contribution and security guidelines

Author: Mastercuber

CONTRIBUTING.md

@@ -0,0 +1,65 @@
+# Contributing to @avensio/graph
+
+Thanks for helping improve the graph data-structure! This document explains how to get started, what quality gates we expect, and how releases are coordinated.
+
+## Project layout
+
+- **Source** lives under `src/` (lists, queues, heaps, etc.)
+- **Tests** live under `test/` (Vitest) with micro-benchmarks under `test/benchmarks/`
+- **Docs** live under `docs/` and are rendered via VitePress
+- **Tooling** scripts live in `scripts/` (including git hooks)
+
+## Prerequisites
+
+- Node.js 20+ and pnpm 10.20+
+- Run `pnpm install` from the repo root (monorepo) so shared tooling is linked
+
+## Workflow
+
+1. **Create a branch** from `main`.
+2. **Develop with safety nets**:
+   - `pnpm dev` for watch mode with coverage
+   - `pnpm test` for the full Vitest suite
+   - `pnpm bench` for micro-benchmarks when touching performance-sensitive paths
+3. **Update docs** alongside code:
+   - Page content in `docs/*.md`
+   - API reference via `pnpm docs:api`
+4. **Validate the docs site**: `pnpm docs:dev` and `pnpm docs:build && pnpm docs:preview`
+5. **Commit and create PR**; `scripts/hooks/commit-msg.mjs` enforces commitlint with tags given in `changelog.config.ts`
+
+Before pushing, run:
+
+```bash
+pnpm lint
+pnpm test
+```
+
+## Pull requests
+
+- Keep changes focused; separate refactors from features/fixes.
+- Add tests for regressions or new behavior.
+- Update docs and changelog entries when user-facing changes occur.
+- Reference related issues (e.g., `Fixes #123`).
+
+## Release process
+
+Releases are handled via the `pnpm release` script, which runs tests, builds, generates docs, and updates the changelog. The [mono-repo](https://github.com/Avensio/avensio) contains CI workflows that publish documentation and packages once changes land on `main`.
+
+If you need to cut a release manually:
+
+```bash
+pnpm release
+# follow the prompts and push the resulting tag
+```
+
+## Reporting bugs & requesting features
+
+Use the GitHub issue templates (`Bug report` / `Feature request`). Provide reproducible steps, environment details, and failing tests where possible.
+
+## Security
+
+Please follow the steps in [SECURITY.md](./SECURITY.md) for reporting vulnerabilities privately.
+
+## License
+
+By contributing, you agree that your contributions are licensed under the MIT License.

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+| ------- | --------- |
+| Latest release (`main`) | ✅ |
+| Older releases | ❌ |
+
+We focus fixes on the latest published version of `@avensio/graph`. If you depend on an older release, please upgrade before reporting issues when possible.
+
+## Reporting a vulnerability
+
+1. **Do not** open a public issue.
+2. Email `security@avensio.de` (or use the contact form on [https://www.avensio.de](https://www.avensio.de)) with:
+   - A detailed description of the vulnerability.
+   - Steps or proof-of-concept to reproduce it.
+   - The environment (Node.js version, browser, OS).
+3. You will receive acknowledgement within 3 business days.
+4. We will work with you on a fix timeline and publish a disclosure once a patched version is available.
+
+Thank you for helping keep the Avensio ecosystem safe.