From e2bdecbbbf58296da120c95fab2acd5fa2819750 Mon Sep 17 00:00:00 2001
From: Your Name <your.email@example.com>
Date: Wed, 27 May 2026 11:39:03 +0800
Subject: [PATCH] docs: add support policy

---
 .github/ISSUE_TEMPLATE/config.yml |  3 ++
 README.md                         |  1 +
 SUPPORT.md                        | 57 +++++++++++++++++++++++++++++++
 3 files changed, 61 insertions(+)
 create mode 100644 SUPPORT.md

diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 5ebaa6f04..3ef5e43b8 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -6,3 +6,6 @@ contact_links:
   - name: Release readiness and contribution rules
     url: https://github.com/lanmu1818-ship-it/ai-chatbot/blob/main/CONTRIBUTING.md
     about: Read docs/release-readiness.md and CONTRIBUTING.md before opening broad engineering requests.
+  - name: Support and operations help
+    url: https://github.com/lanmu1818-ship-it/ai-chatbot/blob/main/SUPPORT.md
+    about: Read SUPPORT.md for bug, feature, deployment, operations, and security support boundaries.
diff --git a/README.md b/README.md
index cd9817d95..34ab71e38 100644
--- a/README.md
+++ b/README.md
@@ -114,6 +114,7 @@ tests/                       Playwright e2e and route-level tests
 - [安全策略](SECURITY.md)
 - [贡献指南](CONTRIBUTING.md)
 - [行为准则](CODE_OF_CONDUCT.md)
+- [支持说明](SUPPORT.md)
 
 ## 开发边界
 
diff --git a/SUPPORT.md b/SUPPORT.md
new file mode 100644
index 000000000..af43916c0
--- /dev/null
+++ b/SUPPORT.md
@@ -0,0 +1,57 @@
+# Support
+
+This document explains where to ask for help and what information to include.
+
+## Before Asking
+
+Please check:
+
+- `README.md` for setup and project boundaries.
+- `docs/deployment.md` for production deployment.
+- `docs/operations.md` for quality gates, logging, and smoke tests.
+- `docs/release-readiness.md` for release verification.
+- Existing GitHub issues.
+
+## Bugs
+
+Use the Bug report issue template when you can provide reproduction steps.
+
+Include:
+
+- What happened and what you expected.
+- Route, workflow, or UI area affected.
+- Browser, OS, Node, pnpm, and deployment context when relevant.
+- Sanitized logs or screenshots.
+
+Do not include secrets, cookies, OAuth codes, Authorization headers, signed URLs, `.env.local` values, private prompts, base64 data, or private user content.
+
+## Feature Requests
+
+Use the Feature request issue template. Keep proposals focused and include:
+
+- The user or operator problem.
+- Proposed behavior or API shape.
+- Acceptance criteria.
+- Relevant alternatives considered.
+
+## Security Issues
+
+Do not open public issues for vulnerabilities, auth bypasses, token leaks, signed URL exposure, private data exposure, or suspicious dependency behavior.
+
+Follow `SECURITY.md` and report privately to the maintainer.
+
+## Deployment and Operations Help
+
+For deployment questions, include sanitized versions of:
+
+- Hosting target.
+- Node and pnpm versions.
+- Database/storage provider type.
+- Relevant command output.
+- Whether `pnpm check:quality` and `pnpm smoke:routes` pass.
+
+Never paste real environment variables. Use placeholder names from `.env.example`.
+
+## Maintainer Expectations
+
+The project is maintained as a production-oriented codebase. Issues and discussions that include unsafe secrets, private user data, or unsanitized provider payloads may be edited or closed to protect users and operators.