docs: add SECURITY.md and a pull request template

[cooperability]

Problem

The Roadmap listed SECURITY.md, CODEOWNERS, a PR template, and a LICENSE as missing, and the repo had none of the four. This PR closes two of them.

Approach

• SECURITY.md at repo root (the convention GitHub's Security tab looks for). Supported versions: the deployed site at https://www.cooperability.com, built from main only, no release branches. Scope: pages, src/app/api routes (planned, not yet built), the service worker, and HTTP headers. Out of scope: third-party services.
• .github/pull_request_template.md, derived from what recent human-authored merged PRs in this repo already contain (docs: cut the root README to a systems overview, move the rest into docs/ #292, docs: reorder Roadmap by priority, slot in issue #253's fix #297): Problem, Approach, a Verification checklist of the four local CI gates, and Deferred. Kept under 25 lines.
• docs/Roadmap.md line 62 edited in place (not moved to the done pile, since it's only partly complete): marks SECURITY.md and the PR template done, keeps CODEOWNERS and LICENSE open.

Decisions

• SECURITY.md at repo root, not .github/. GitHub's docs list the root as the primary supported location for the Security tab to surface the policy; .github/SECURITY.md also works but root is the more common convention and what most tooling checks first.
• No email address anywhere in SECURITY.md. Checked gh api repos/cooperability/cooperability.com/private-vulnerability-reporting: {"enabled":false}. Since GitHub private vulnerability reporting is off, the file says reporting goes through the Security tab once enabled, and falls back to a plain GitHub issue in the meantime. No response-time commitment, since none exists.
• CODEOWNERS and LICENSE excluded deliberately, per the task: CODEOWNERS auto-requests review from a human, and a license is a legal choice only the repo owner can make.

Verification

• pnpm lint exit 0
• pnpm typecheck (not run separately; pnpm test and pnpm build gates below cover the touched files, which are all Markdown)
• pnpm test exit 0 (11 suites, 66 tests)
• npx prettier --check SECURITY.md .github/pull_request_template.md docs/Roadmap.md exit 0
• deai-lint.sh clean on both new files
• Confirmed via GitHub's docs that .github/pull_request_template.md is a supported default-template path

Deferred

• CODEOWNERS: out of scope for this slice, since it auto-requests review from a human and nobody should be paged by this PR.
• LICENSE: out of scope, since choosing one is the owner's legal decision.
• Enabling private vulnerability reporting: a one-click toggle in repo Settings → Security. Currently off. Once enabled, the Security tab's "Report a vulnerability" becomes the reporting path SECURITY.md already points to.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
portfolio	Ready	Preview	Sep 20, 2026 5:00pm UTC