chore: harden the open-source repo

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Every change needs the maintainer's review.
+* @harshmathurx

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,6 @@
+# Blank issues stay enabled: Lector's "Report a problem" button opens a pre-filled blank issue.
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/harshmathurx/lector/security/advisories/new
+    about: Please report security issues privately, not as a public issue.

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      dev:
+        dependency-type: development
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/pull_request_template.md

@@ -0,0 +1,9 @@
+## What and why
+
+## How I tested
+- [ ] `bun run typecheck`, `bun test`, `bun run build`
+- [ ] Tried it in Chrome on a real article (say which)
+- [ ] For playback, chunking or engine changes: `scripts/e2e.mjs` (see its header)
+
+## Privacy
+- [ ] No new permissions, network requests, or page data leaving the browser (or explained above)

.github/workflows/ci.yml

@@ -3,12 +3,21 @@ on:
   push:
     branches: [main]
   pull_request:
+permissions:
+  contents: read
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      # Actions are pinned to commit SHAs; Dependabot keeps them current.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - run: bun install --frozen-lockfile
       - run: bun run typecheck
       - run: bun test

CONTRIBUTING.md

@@ -25,6 +25,10 @@ bun test
 2. If you touched playback, extraction or messaging, run `scripts/e2e.mjs` (header explains setup) or describe how you tested by hand.
 3. Note what you could not verify. We would rather know.
 
+## Pull requests
+
+`main` is protected: changes land through pull requests that pass CI and are approved by the maintainer (see `.github/CODEOWNERS`). Release tags (`v*`) can only be created by the maintainer.
+
 ## Releasing
 
 1. Bump `version` in `static/manifest.json` (and `package.json`).
@@ -39,6 +43,9 @@ bun test
 
 ## Reporting bugs
 
+The easiest way: Lector popup → Settings → **Report a problem** fills in your versions for you. Security issues go through [SECURITY.md](SECURITY.md), never a public issue.
+
+
 Please include the page URL (or a minimal HTML example), your Chrome version, whether you are on WebGPU or CPU (Settings in the popup shows this), and any errors from `chrome://extensions` → Lector → *service worker* / *offscreen.html* consoles.
 
 ## Architecture

SECURITY.md

@@ -0,0 +1,13 @@
+# Security policy
+
+Lector runs entirely in your browser: no account, no server, and no page content leaves your computer. The only network access is the one-time voice model download from Hugging Face.
+
+## Reporting a vulnerability
+
+Please report security issues **privately** through [GitHub's private vulnerability reporting](https://github.com/harshmathurx/lector/security/advisories/new), not as a public issue. Include what you found, how to reproduce it, and the Lector version (Settings in the popup, or `chrome://extensions`).
+
+You should get a reply within a week. Fixes ship in a new release on GitHub and the Chrome Web Store, and reporters are credited unless they'd rather not be.
+
+## Supported versions
+
+Only the latest release is supported.