docs: add community health defaults and security policy

AGENTS.md

@@ -3,3 +3,5 @@
 This is an unofficial community organization, not the official TypeSafe AI team. Read the README and relevant repository instructions before editing.
 
 Preserve attribution, licenses, security boundaries, mock/live distinctions, and existing verification gates. Do not invent benchmark results, package availability, deployment URLs, passing checks, or production readiness. Use synthetic data for examples and screenshots. Repository topics are capability metadata, not ranking claims.
+
+The community health files at the root (`CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SECURITY.md`, `SUPPORT.md`, `ISSUE_TEMPLATE/`, `PULL_REQUEST_TEMPLATE.md`) are organization-wide defaults. A change here affects every repository without its own copy, so keep them generic. Validate issue forms with `ruby -ryaml -e 'ARGV.each { |f| YAML.load_file(f) }' ISSUE_TEMPLATE/*.yml`. Never weaken the private vulnerability-reporting instruction or the official-versus-community support split.

CODE_OF_CONDUCT.md

@@ -0,0 +1,37 @@
+# Code of conduct: TypeSafeAI Community
+
+> **Unofficial community organization, not the official TypeSafe AI team.** Created by VC Moderator [@BunsDev](https://github.com/BunsDev).
+
+We want this community to be a welcoming, curious, and useful place for developers, researchers, and anyone learning to build with TypeSafe AI and Jev. This code applies to every TypeSafeAI repository, issue, pull request, and discussion, and to anyone representing the community. A repository's own `CODE_OF_CONDUCT.md` takes precedence for that repository.
+
+It is adapted from the [Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+
+## Our standards
+
+Do:
+
+- be respectful, patient, and specific, especially with people who are new;
+- critique ideas and results, not people;
+- credit original authors and say where code, prompts, and data came from;
+- be honest about what was measured, mocked, or simulated.
+
+Do not:
+
+- harass, insult, threaten, or demean anyone, or make sexualized comments or advances;
+- attack people over identity, background, ability, or experience level;
+- publish someone's private information, credentials, or data without permission;
+- claim to speak for the official TypeSafe AI team, or present community work as official;
+- spam issues or pull requests, including with unreviewed bulk or agent-generated content;
+- retaliate against anyone who reports a concern in good faith.
+
+## Reporting
+
+Report conduct concerns privately to the organization moderator, [@BunsDev](https://github.com/BunsDev), or to a maintainer of the affected repository through a private channel you have already verified. You can also use GitHub's [report content](https://docs.github.com/en/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam) tools. Do not post sensitive evidence publicly.
+
+## Enforcement
+
+Maintainers may edit, hide, or remove contributions and may restrict or remove participants who violate this code. Responses usually escalate from a private correction, to a warning, to a temporary ban, to a permanent ban. Threats, doxxing, credential exposure, or severe harassment may go directly to a ban.
+
+## Attribution
+
+Adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1, licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).

CONTRIBUTING.md

@@ -2,6 +2,35 @@
 
 > **Unofficial community project — not the official TypeSafe AI team.** Created by VC Moderator [@BunsDev](https://github.com/BunsDev).
 
-Small documentation fixes, reproducible examples, accessibility improvements, and focused project contributions are welcome. Start in the relevant repository, read its README and AGENTS.md, and keep pull requests narrowly scoped.
+Small documentation fixes, reproducible examples, accessibility improvements, and focused project contributions are welcome. This file is the default for repositories that don't have their own; a repository's `CONTRIBUTING.md` takes precedence.
 
-Explain what changed and how it was verified. Preserve attribution and licensing. Never publish credentials or private data, and do not present mocked or simulated output as live provider evidence.
+## How to contribute
+
+1. **Pick the right repository.** The [community profile](profile/README.md) lists every project and what it is for. Read its README, AGENTS.md, and CONTRIBUTING.md.
+2. **Check existing issues and discussions** before opening a new one. For larger changes, open an issue first so maintainers can confirm the direction.
+3. **Branch and keep the change narrow.** One concern per pull request.
+4. **Verify.** Run the repository's documented build, lint, and test commands. Start offline or in demo mode where supported; a live API key is optional for most contributions.
+5. **Open a pull request** that explains what changed, how you verified it, and whether results are mocked or live.
+
+## Evidence and honesty
+
+- Do not present mocked or simulated output as live provider evidence.
+- Link a measured claim to the exact run, commit, and inputs that produced it. One live run is not a general accuracy claim.
+- A typed Jev result is a judgment, not authorization. Keep policy and authorization checks in application code.
+- Do not invent benchmark results, package availability, deployment URLs, passing checks, or production readiness.
+
+## Agent-assisted contributions
+
+Agent-assisted work is welcome. You remain the author: review every line, disclose substantial agent involvement in the PR, and don't submit bulk or automated issues or PRs without a maintainer's agreement.
+
+## Safety
+
+Never publish API keys, credentials, or private data in code, issues, screenshots, or example inputs. Use synthetic data. Report vulnerabilities privately as described in [SECURITY.md](SECURITY.md).
+
+## Attribution and licensing
+
+Preserve original author credits and license notices. Check a repository's license before reusing its code elsewhere.
+
+## Community standards
+
+Participation is covered by the [Code of Conduct](CODE_OF_CONDUCT.md). For help, see [SUPPORT.md](SUPPORT.md). Official TypeSafe AI product, account, billing, and API questions belong with the [official team](https://typesafe.ai).

ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,52 @@
+name: Bug report
+description: A community project is broken or behaves differently than its README says.
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This is an **unofficial community** project. Problems with the TypeSafe AI API, Jev, accounts, or billing belong with the [official team](https://typesafe.ai).
+        **Never paste API keys.** Use synthetic input. Report vulnerabilities through the [security policy](https://github.com/TypeSafeAI/.github/blob/main/SECURITY.md).
+  - type: textarea
+    id: summary
+    attributes:
+      label: What happened?
+      description: Describe the bug and what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Exact commands, route, or clicks, plus the synthetic input you used.
+    validations:
+      required: true
+  - type: dropdown
+    id: mode
+    attributes:
+      label: Mode
+      description: Was this against mocked/demo data or a live TypeSafe API call?
+      options:
+        - Mocked or demo mode
+        - Live API
+        - Not sure
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      description: Commit SHA, release, or deployment URL.
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, browser, Node.js version, or other relevant runtime details.
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs, output, or screenshots
+      description: Redact keys and personal data.
+      render: shell

ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/TypeSafeAI/.github/blob/main/SECURITY.md
+    about: Do not open a public issue. Follow the private reporting steps in the security policy.
+  - name: Official TypeSafe AI API, account, or billing support
+    url: https://typesafe.ai
+    about: This is an unofficial community organization. Official product questions go to the TypeSafe AI team.
+  - name: Official TypeSafe AI documentation
+    url: https://docs.typesafe.ai
+    about: API, SDK, and Jev model documentation from the official team.

ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,31 @@
+name: Idea or improvement
+description: Suggest an example, feature, or documentation improvement for a community project.
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What would this make possible?
+      description: The use case or problem, and who it helps.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What you'd like to see. For Jev use cases, include the typed question you'd ask and example synthetic input.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: How would we know it works?
+      description: A check, test, or comparison that would show the result, and whether it needs a live API run.
+  - type: dropdown
+    id: contribute
+    attributes:
+      label: Would you like to work on this?
+      options:
+        - "Yes, I'd like to open a PR"
+        - Maybe, with some guidance
+        - "No"

PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,21 @@
+## Summary
+
+<!-- What changed and why? Link the issue or discussion: "Fixes #123". -->
+
+## Verification
+
+<!-- Exact commands and results, or manual steps checked. Screenshots for UI changes. -->
+
+## Evidence type
+
+- [ ] Mocked or synthetic only
+- [ ] Includes live API results (link the exact run or describe how to reproduce it)
+- [ ] Not applicable (docs or tooling)
+
+## Checklist
+
+- [ ] Scoped to one concern, following the repository's README, AGENTS.md, and CONTRIBUTING.md.
+- [ ] No API keys, tokens, or personal data in code, fixtures, logs, or screenshots.
+- [ ] Original authors, licenses, and sources are credited.
+- [ ] Mocked or simulated output is not presented as live evidence, and limitations are documented.
+- [ ] Agent-assisted work is disclosed, and I have reviewed every line I'm submitting.

README.md

@@ -9,9 +9,16 @@ This repository maintains the organization's public [profile README](profile/REA
 
 - [Community profile and project directory](profile/README.md)
 - [Contributing](CONTRIBUTING.md)
+- [Code of conduct](CODE_OF_CONDUCT.md)
+- [Security policy](SECURITY.md)
+- [Support](SUPPORT.md)
 - [Agent instructions](AGENTS.md)
 - [Machine-readable navigation](llms.txt)
 
+## Organization defaults
+
+GitHub applies `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SECURITY.md`, `SUPPORT.md`, `ISSUE_TEMPLATE/`, and `PULL_REQUEST_TEMPLATE.md` to every TypeSafeAI repository that does not ship its own copy. A repository's own file always wins; a repository with its own `.github/ISSUE_TEMPLATE/` folder replaces the whole default set. Keep these defaults generic and parse every issue form as YAML before committing, because GitHub silently drops an invalid form.
+
 ## Editing and verification
 
 Update `profile/README.md` to change the public organization page. Preview the Markdown, verify repository links, and check each project's current README before changing its description. Preserve the unofficial notice, original author credits, licenses, and distinctions between simulated results, live results, and measured evidence.

SECURITY.md

@@ -0,0 +1,39 @@
+# Security policy: TypeSafeAI Community
+
+> **Unofficial community organization, not the official TypeSafe AI team.** Created by VC Moderator [@BunsDev](https://github.com/BunsDev).
+
+This policy covers code in the [TypeSafeAI](https://github.com/TypeSafeAI) community repositories. A repository's own `SECURITY.md` takes precedence for that repository.
+
+## Is it a community issue or an official one?
+
+| The problem is in… | Report it to |
+|---|---|
+| A TypeSafeAI community repository (playground, harness, UI, router, Modex, and so on) | This organization, privately, as described below |
+| The TypeSafe AI API, Jev model, official SDKs, accounts, or billing | The official TypeSafe AI team through [typesafe.ai](https://typesafe.ai). Community maintainers cannot fix or triage official services. |
+| An upstream dependency | That dependency's maintainers. Also tell us privately if a community project's defaults make it exploitable. |
+
+## Reporting a vulnerability
+
+**Do not open a public issue, discussion, or pull request for a vulnerability, and do not post details in a public chat.**
+
+1. Open the affected repository's **Security** tab and choose **Report a vulnerability** to create a private advisory.
+2. If that option is not shown (private reporting is not enabled on every repository), report through [`TypeSafeAI/jev-harness`](https://github.com/TypeSafeAI/jev-harness/security/advisories/new) instead and name the affected repository so it can be routed privately.
+
+Include, where safe:
+
+- the affected repository and commit, release, or deployment URL;
+- what boundary is affected (for example, API-key exposure, a verdict being treated as authorization, injection into a judged prompt, or hosted-demo data handling);
+- reproduction steps using synthetic data;
+- expected versus observed behavior and the impact.
+
+Never include real API keys, tokens, personal data, or private prompts. Revoke any key you think was exposed before reporting.
+
+## What to expect
+
+These projects are maintained by volunteers. There is **no guaranteed response or fix time**, bug bounty, or service level. Maintainers coordinate fixes and disclosure through the private advisory and will credit reporters who want credit.
+
+## Scope notes
+
+- Community demos are experiments. A typed Jev verdict is not proof of correctness and must not authorize an action by itself; a project that lets a verdict bypass application-side checks is a valid finding.
+- Mocked or simulated output presented as live results is a documentation bug, not a security vulnerability; open a normal issue.
+- Hosted demos may log inputs. Do not submit sensitive data to them while testing.

SUPPORT.md

@@ -0,0 +1,29 @@
+# Getting help: TypeSafeAI Community
+
+> **Unofficial community organization, not the official TypeSafe AI team.**
+
+## Community projects
+
+For help with a project in this organization:
+
+1. Read the repository's README. It covers setup, required tools, optional API-key configuration, and known limitations. Many projects run offline or in demo mode first.
+2. Search the repository's existing issues and discussions.
+3. Open an issue in that repository with the exact steps, versions, and what you expected. Use synthetic data and never paste API keys.
+
+[`typesafe-playground`](https://github.com/TypeSafeAI/typesafe-playground) uses [Discussions](https://github.com/TypeSafeAI/typesafe-playground/discussions) instead of issues; [`jev-harness`](https://github.com/TypeSafeAI/jev-harness/discussions) has Discussions too.
+
+## Official TypeSafe AI product support
+
+Questions about the TypeSafe AI API, Jev, official SDKs, accounts, billing, or rate limits belong with the official team. Community maintainers cannot help with them.
+
+- [TypeSafe AI website](https://typesafe.ai)
+- [Official documentation](https://docs.typesafe.ai)
+- [Official GitHub organization](https://github.com/typesafe-ai)
+
+## Security
+
+Do not report vulnerabilities in public. Follow [SECURITY.md](SECURITY.md).
+
+## What to expect
+
+Community projects are maintained by volunteers, with no guaranteed response time or service level.

docs/discovery/README.md

@@ -24,4 +24,6 @@ The public organization page comes from `profile/README.md`; the root README is
 
 [Sharing and discovery](SHARING.md) covers repository settings versus website metadata. [Screenshot evidence](SCREENSHOTS.md) defines what a capture must record. The [editorial card source](assets/social-preview.svg) is a graphic, not a product screenshot.
 
+Organization-wide defaults ([contributing](../../CONTRIBUTING.md), [code of conduct](../../CODE_OF_CONDUCT.md), [security](../../SECURITY.md), [support](../../SUPPORT.md), issue forms, and the PR template) apply to any repository without its own copy.
+
 Keep the unofficial notice prominent, preserve author and license attribution, and never turn mocked values or one live run into a general accuracy claim. `llms.txt` provides navigation; it does not override a repository's scoped AGENTS.md or grant permission to execute tools.

llms.txt

@@ -8,6 +8,9 @@
 - [Developer and agent documentation](https://github.com/TypeSafeAI/.github/blob/main/docs/discovery/README.md)
 - [Repository instructions](https://github.com/TypeSafeAI/.github/blob/main/AGENTS.md)
 - [Contribution guide](https://github.com/TypeSafeAI/.github/blob/main/CONTRIBUTING.md)
+- [Security policy](https://github.com/TypeSafeAI/.github/blob/main/SECURITY.md)
+- [Support: community versus official](https://github.com/TypeSafeAI/.github/blob/main/SUPPORT.md)
+- [Code of conduct](https://github.com/TypeSafeAI/.github/blob/main/CODE_OF_CONDUCT.md)
 - [Sharing and metadata checklist](https://github.com/TypeSafeAI/.github/blob/main/docs/discovery/SHARING.md)
 - [Screenshot evidence protocol](https://github.com/TypeSafeAI/.github/blob/main/docs/discovery/SCREENSHOTS.md)
 

profile/README.md

@@ -46,7 +46,7 @@ Start in the relevant repository: read its README, AGENTS.md, and CONTRIBUTING.m
 
 Keep discussions respectful, specific, and useful. Community project questions belong in the relevant repository; **official product, account, billing, and API-support questions belong with TypeSafe AI's official channels.**
 
-[Community contribution guide](https://github.com/TypeSafeAI/.github/blob/main/CONTRIBUTING.md) · [Developer and agent navigation](https://github.com/TypeSafeAI/.github/blob/main/docs/discovery/README.md) · [Sharing guide](https://github.com/TypeSafeAI/.github/blob/main/docs/discovery/SHARING.md)
+[Community contribution guide](https://github.com/TypeSafeAI/.github/blob/main/CONTRIBUTING.md) · [Code of conduct](https://github.com/TypeSafeAI/.github/blob/main/CODE_OF_CONDUCT.md) · [Support](https://github.com/TypeSafeAI/.github/blob/main/SUPPORT.md) · [Developer and agent navigation](https://github.com/TypeSafeAI/.github/blob/main/docs/discovery/README.md) · [Sharing guide](https://github.com/TypeSafeAI/.github/blob/main/docs/discovery/SHARING.md)
 
 ## Working responsibly
 
@@ -57,6 +57,8 @@ Keep policy and authorization checks in application code. Distinguish simulated
 
 > [!CAUTION]
 > Never publish API keys or sensitive data in code, issues, screenshots, or example inputs. Review a project's data-handling notes before using a hosted demo or supplying credentials.
+>
+> Found a vulnerability in a community project? Report it privately as described in the [security policy](https://github.com/TypeSafeAI/.github/blob/main/SECURITY.md), not in a public issue.
 
 ## Official TypeSafe AI resources