Initial Coworker app scaffold

SECURITY.md

@@ -0,0 +1,29 @@
+# Security
+
+Coworker is a local-first coding app with powerful project and agent capabilities. Treat it like a developer tool with access to your files and local model endpoints.
+
+## Reporting
+
+Open a private issue or contact the repository owner if a vulnerability exposes files, tokens, local services, paired devices, or agent permissions.
+
+## Defaults
+
+- Web access is disabled by default.
+- LAN/Tailscale access requires an explicit settings change.
+- Mobile access requires a pairing code.
+- Device tokens are stored as hashes.
+- Workspace file access is confined to selected project roots.
+- Agent file writes and command execution require visible approval.
+
+## Secrets
+
+Never commit:
+
+- `.env` files,
+- API keys,
+- provider tokens,
+- pairing tokens,
+- certificates,
+- private keys,
+- app data,
+- generated installers outside release artifacts.