docs: rename docs/security.md to docs/content-security-policy.md; the organization SECURITY.md is the reporting policy.

.editorconfig

@@ -0,0 +1,26 @@
+# editorconfig.org
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = true
+
+# Prettier owns Markdown indentation; ordered-list continuations are 3 spaces.
+[*.md]
+indent_size = unset
+trim_trailing_whitespace = false
+
+[*.yaml]
+indent_size = 2
+
+[*.yml]
+indent_size = 2
+
+[LICENSE*]
+indent_style = unset
+indent_size = unset

.github/linters/.codespellrc

@@ -0,0 +1,2 @@
+[codespell]
+skip = ./.git,.claude/*,.codex/*,.config/gh/*,.github/agents/*,.github/copilot-instructions.md,.github/copilot/*,.github/instructions/*,.github/prompts/*,.github/skills/*,.vscode/*,logo/*

.github/linters/.editorconfig-checker.json

@@ -0,0 +1,17 @@
+{
+    "Exclude": [
+        "\\.min\\.css$",
+        "\\.min\\.js$",
+        "^\\.claude/",
+        "^\\.codex/",
+        "^\\.config/gh/",
+        "^\\.github/agents/",
+        "^\\.github/copilot-instructions\\.md$",
+        "^\\.github/copilot/",
+        "^\\.github/instructions/",
+        "^\\.github/prompts/",
+        "^\\.github/skills/",
+        "^\\.vscode/",
+        "^logo/"
+    ]
+}

.github/linters/.gitleaks.toml

@@ -0,0 +1,4 @@
+title = "gitleaks config"
+
+[extend]
+useDefault = true

.github/linters/.markdown-lint.yml

@@ -0,0 +1,5 @@
+---
+MD007:
+  indent: 2
+MD013: false
+MD033: false

.github/workflows/quality.yml

@@ -0,0 +1,22 @@
+---
+on:
+  - pull_request
+  - push
+
+name: quality
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    uses: yii2-framework/actions/.github/workflows/quality.yml@e02758a41a2a811fb3e706735192979171b2260d # v2.0.1
+    permissions:
+      contents: read
+    with:
+      codespell-config: .github/linters/.codespellrc
+      editorconfig-checker-config: .github/linters/.editorconfig-checker.json
+      markdownlint-config: .github/linters/.markdown-lint.yml
+      prettier-config: .prettierrc.json
+      prettier-ignore-path: .prettierignore
+      yamllint-targets: .github

.github/workflows/security.yml

@@ -0,0 +1,19 @@
+---
+on:
+  - pull_request
+  - push
+
+name: security
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    uses: yii2-framework/actions/.github/workflows/security.yml@e02758a41a2a811fb3e706735192979171b2260d # v2.0.1
+    permissions:
+      contents: read
+    with:
+      gitleaks-config: .github/linters/.gitleaks.toml
+    secrets:
+      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

.prettierignore

@@ -0,0 +1,11 @@
+# Local agent and editor state.
+.claude/**
+.codex/**
+.config/gh/**
+.github/agents/**
+.github/copilot-instructions.md
+.github/copilot/**
+.github/instructions/**
+.github/prompts/**
+.github/skills/**
+.vscode/**

.prettierrc.json

@@ -0,0 +1,22 @@
+{
+    "tabWidth": 4,
+    "useTabs": false,
+    "singleQuote": false,
+    "trailingComma": "all",
+    "printWidth": 80,
+    "overrides": [
+        {
+            "files": ["**/*.{yml,yaml}"],
+            "options": {
+                "tabWidth": 2
+            }
+        },
+        {
+            "files": "**/*.md",
+            "options": {
+                "embeddedLanguageFormatting": "off",
+                "tabWidth": 2
+            }
+        }
+    ]
+}

SECURITY.md

@@ -4,26 +4,24 @@
 
 **Do not open a public issue for security vulnerabilities.**
 
-Use the GitHub Security Advisories feature in the affected repository to report vulnerabilities privately:
+Use GitHub's private vulnerability reporting in the affected repository:
 
-1. Navigate to the affected repository (for example, `https://github.com/php-forge/<repository>`, replacing
-   `<repository>` with the affected repository).
+1. Open the affected repository under `https://github.com/php-forge/<repository>`.
 2. Go to the **Security** tab.
-3. Click **Report a vulnerability**.
-4. Provide a detailed description including steps to reproduce, impact, and any suggested fix.
+3. Click **Report a vulnerability** and describe the issue, how to reproduce it, its impact and any suggested fix.
 
-For more information, see [Privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability).
+See [Privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability).
+
+If the **Report a vulnerability** button is not available in a repository, open a public issue that only asks for a private contact. Do not include vulnerability details in it.
 
 ## Supported Versions
 
-Security fixes are applied to the latest release of each package. Older versions do not receive security updates.
+Security fixes are applied to the latest stable release of each package unless the repository documents a different support policy. Older and development versions receive no security updates, although reports about them are welcome.
 
-## Response Timeline
+## Response
 
-- **Acknowledgment**: Within 48 hours of the report.
-- **Assessment**: Within 7 days, an initial assessment and plan of action.
-- **Fix and disclosure**: A fix is developed, tested, and released before public disclosure.
+This project is maintained on a best-effort basis. Reports are reviewed as maintainer availability permits; receipt is acknowledged and updates are given through the private report. No acknowledgment, assessment or remediation deadline is guaranteed. Please do not include vulnerability details in public issues or discussions.
 
 ## Scope
 
-This policy applies to all repositories under the [PHP Forge](https://github.com/php-forge) organization.
+This policy applies to all repositories under the [php-forge](https://github.com/php-forge) organization.

profile/README.md

@@ -3,7 +3,7 @@
 
 # PHP Forge
 
-**Code Craftsmanship for Reliability**
+<strong>Code Craftsmanship for Reliability</strong>
 
 Foundational, framework-agnostic tools that power the next generation of PHP applications.