add security disclosure documents

docs/BUG_REPORT_TEMPLATE.md

@@ -0,0 +1,75 @@
+# Bug Report Template
+
+> **I will not respond to bug reports that are the equivalent of "It does
+> not work!"** Provide the information below — what you did, what happened,
+> what you expected, and your environment. Reports without these details
+> will be closed without response.
+
+Copy the section below into a new GitHub issue at
+<https://github.com/forkless/NotAlterra/issues/new> and fill it out.
+
+---
+
+```markdown
+### Describe the bug
+
+What happened?  What did you expect to happen instead?
+
+### Steps to reproduce
+
+1.
+2.
+3.
+
+### Environment
+
+- **OS**: (e.g. Windows 11, Ubuntu 24.04, Steam Deck)
+- **NotAlterra version**: (shown in the title bar, e.g. v0.4.0)
+- **Subnautica 2 install**: (Steam, Xbox, Epic, custom)
+
+### Logs
+
+If available, attach the `transaction.log` file located next to the
+binary (`logs/transaction.log`).
+
+### Screenshots (optional)
+
+If the terminal output is relevant, paste a screenshot or a copy of the
+on-screen text.
+```
+
+---
+
+## Privacy
+
+Do not paste save file contents, personal names, or anything you consider
+private into the issue. Do not paste full file paths that might reveal
+your real name or system layout — the tool's `transaction.log` is
+sanitized, but your issue is public.
+
+When in doubt, omit it. Include only what is necessary to reproduce the
+problem.
+
+---
+
+## Security Issues
+
+**Do not** report security vulnerabilities through a public GitHub issue.
+
+### Preferred: GitHub Private Vulnerability Reporting
+
+1. Go to the repository's **Security** tab:
+   <https://github.com/forkless/NotAlterra/security/advisories>
+2. Click **Report a vulnerability** — the thread is private by default.
+
+### Fallback: Email
+
+If you cannot use the GitHub advisory form, email the maintainer:
+
+- **Email**: forkless@protonmail.com
+- **GPG key**: [314BB48A3C72D8EC2830B8BED2B0DF63E2CBEA16](https://github.com/forkless.gpg)
+
+Reports are acknowledged within 48 hours. Patches are committed within
+48 hours of triage, followed by a public advisory after the release ships.
+
+For more detail, see `SECURITY.md` in the project root.

docs/CVE_TEMPLATE.md

@@ -0,0 +1,108 @@
+# CVE Vulnerability Report Template
+
+**CVE** (Common Vulnerabilities and Exposures) is a standardized identifier
+for publicly known security vulnerabilities — `CVE-2026-XXXXX`. Not every
+bug qualifies; CVEs are reserved for security-relevant flaws that affect
+confidentiality, integrity, or availability.
+
+This template helps you report a potential CVE-class vulnerability in
+NotAlterra. Use it before public disclosure — a patch should ship before a
+CVE is published.
+
+---
+
+## ⚠️ No Public Disclosure
+
+**Do not** file a public GitHub issue, post on forums, or discuss the
+vulnerability on social media before a patch is released. Premature
+disclosure puts every user of the tool at risk.
+
+Report privately to the maintainer instead (see below).
+
+---
+
+## Template
+
+Copy and fill out the section below into an email. Attach supporting files
+(proof-of-concept, logs, crash dumps) directly.
+
+```
+Subject: [NotAlterra Security] <brief description>
+
+### Vulnerability type
+
+- [ ] Path traversal / arbitrary file write
+- [ ] Silent data corruption during backup or restore
+- [ ] Denial of service (crash / hang on crafted input)
+- [ ] Dependency vulnerability (CVE in a library)
+- [ ] Other: ___________
+
+### Description
+
+What does the vulnerability allow an attacker to do?  What conditions
+are required?
+
+### Steps to reproduce
+
+1.
+2.
+3.
+
+### Proof of concept (if applicable)
+
+Attach or paste a minimal input, script, or sequence of actions that
+triggers the issue.
+
+### Affected versions
+
+- NotAlterra version(s): (e.g. v0.4.0)
+- Platform: (Windows / Linux / both)
+
+### Impact assessment
+
+- [ ] Data loss possible
+- [ ] Remote code execution (unlikely — no network surfaces)
+- [ ] Privilege escalation (runs in user context, no admin required)
+- [ ] Other: ___________
+
+### Suggested CVE assignment
+
+- [ ] I intend to request a CVE ID for this issue
+- [ ] I am not requesting a CVE (report only)
+```
+
+---
+
+## Where to Send
+
+### Preferred: GitHub Private Vulnerability Reporting
+
+1. Go to the repository's **Security** tab:
+   <https://github.com/forkless/NotAlterra/security/advisories>
+2. Click **Report a vulnerability**.
+3. Fill in the template fields — the thread is private by default.
+4. GitHub can assign a CVE ID directly through their CNA without MITRE
+   coordination.
+
+### Fallback: Email
+
+If you cannot use the GitHub advisory form, email the maintainer with
+the completed template:
+
+- **Email**: forkless@protonmail.com
+- **GPG key**: [314BB48A3C72D8EC2830B8BED2B0DF63E2CBEA16](https://github.com/forkless.gpg)
+
+Encrypted email is preferred when the report includes sensitive details
+or proof-of-concept code.
+
+## What Happens Next
+
+1. **Acknowledgment** — within 48 hours of receipt.
+2. **Triage** — the maintainer assesses severity and reproduces the issue.
+3. **Patch** — fix committed within 48 hours of triage.
+4. **CVE request** — the maintainer requests a CVE ID from MITRE or a
+   CVE Numbering Authority (CNA) if the issue qualifies.
+5. **Disclosure** — after the patched release ships, a public advisory is
+   published and the CVE is made public.
+
+For the full policy, see `SECURITY.md` in the project root.