docs: add security policy

README.md

@@ -111,6 +111,7 @@ tests/                       Playwright e2e and route-level tests
 - [运维与质量门禁](docs/operations.md)
 - [系统架构说明](docs/architecture.md)
 - [发布就绪检查清单](docs/release-readiness.md)
+- [安全策略](SECURITY.md)
 
 ## 开发边界
 

SECURITY.md

@@ -0,0 +1,69 @@
+# Security Policy
+
+Security is part of the release contract for yedir-ai. This project handles AI provider keys, OAuth credentials, object-storage URLs, user uploads, generated media, and internal generation workflows, so disclosures should be handled carefully and privately.
+
+## Supported Versions
+
+Security fixes are applied to the active `main` branch and release branches maintained by the project owner. Older experimental branches are not guaranteed to receive patches.
+
+## Reporting a Vulnerability
+
+Do not open a public issue for suspected vulnerabilities.
+
+Report privately to the repository owner or project maintainer with:
+
+- A short description of the issue and affected area.
+- Reproduction steps or a minimal proof of concept.
+- Potential impact, including whether secrets, user data, uploads, signed URLs, or internal APIs are exposed.
+- Relevant logs with secrets, cookies, Authorization headers, OAuth codes, signed URLs, prompts, base64 data, and private user content removed.
+
+Expected handling:
+
+- The maintainer will acknowledge the report when it is received.
+- Valid issues will be triaged by impact and exploitability.
+- Fixes should include regression coverage or a documented verification path where practical.
+- Public disclosure should wait until a fix or mitigation is available.
+
+## Sensitive Data Rules
+
+Never commit or paste:
+
+- `.env.local` or real environment variables.
+- API keys, OAuth client secrets, OAuth codes, cookies, session tokens, Authorization headers, or passwords.
+- Signed object-storage URLs, raw upload URLs, private bucket paths, or third-party task payloads.
+- Full prompts, base64 image/video data, or private generated media unless explicitly sanitized.
+
+Use `.env.example` for placeholders only.
+
+## Logging Rules
+
+High-risk server logs should use `createLogger` from `lib/observability/logger`. Browser logs should use `createClientLogger` and stay silent in production unless explicitly enabled.
+
+Before merging security-sensitive changes, run:
+
+```bash
+pnpm check:quality
+```
+
+For route-level release smoke tests, also run:
+
+```bash
+AUTH_TRUST_HOST=true PORT=3001 pnpm dev
+SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes
+```
+
+If a file starts logging prompts, URLs, provider responses, upload details, OAuth data, or user content, add it to `scripts/check-log-hygiene.mjs` and ensure `pnpm check:logs` passes.
+
+## Deployment Security Notes
+
+- Configure `AUTH_SECRET` and production `AUTH_URL`.
+- Use `AUTH_TRUST_HOST=true` only behind a trusted reverse proxy with validated Host headers.
+- Keep database, storage, OAuth, and AI provider credentials in the deployment secret store.
+- Prefer short database connect timeouts and bounded connection pools.
+- Verify `/settings` remains protected and redirects unauthenticated users to login.
+
+See also:
+
+- `docs/deployment.md`
+- `docs/operations.md`
+- `docs/release-readiness.md`

docs/release-readiness.md

@@ -25,6 +25,7 @@ SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes
 - 首页采用轻量壳优先渲染，个性化和公开数据渐进加载。
 - 高风险日志链路已纳入 `pnpm check:logs`，禁止回流裸 `console.*`。
 - CI 基础门禁与本地 `pnpm check:quality` 使用同一套污染物检查脚本。
+- 安全披露、敏感信息和日志规则以根目录 `SECURITY.md` 为准。
 
 ## 不应在发布包中出现