docs: add contributor and security guidelines

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,40 @@
+---
+name: Bug report
+about: Report a reproducible problem in Crucix
+title: "[Bug] "
+labels: bug
+assignees: ""
+---
+
+## Summary
+
+Describe the bug clearly.
+
+## Environment
+
+- OS:
+- Install method: local / Docker / other
+- Node version:
+- LLM provider:
+
+## Steps to Reproduce
+
+1.
+2.
+3.
+
+## Expected Behavior
+
+What should have happened?
+
+## Actual Behavior
+
+What happened instead?
+
+## Logs or Screenshots
+
+Paste relevant logs, screenshots, or terminal output.
+
+## Additional Context
+
+Anything else that helps narrow this down.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security report
+    url: mailto:celesthioailabs@gmail.com
+    about: Report security issues privately instead of opening a public issue.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,35 @@
+---
+name: Feature request
+about: Suggest a feature, source addition, or product improvement
+title: "[Feature] "
+labels: enhancement
+assignees: ""
+---
+
+## Summary
+
+Describe the feature or source you want added.
+
+## Why This Matters
+
+What problem does this solve for Crucix users?
+
+## Scope
+
+- Bug fix:
+- New source:
+- Dashboard/UI change:
+- LLM/provider change:
+- Other:
+
+## Proposed Behavior
+
+Describe the expected behavior or output.
+
+## Maintenance Impact
+
+Note any API keys, rate limits, paid services, dependencies, or ongoing upkeep this would add.
+
+## Additional Context
+
+Links, examples, screenshots, or references.

.github/pull_request_template.md

@@ -0,0 +1,45 @@
+## Summary
+
+Describe what changed.
+
+## Why
+
+Explain the problem being solved.
+
+## Scope
+
+- [ ] Focused bug fix
+- [ ] Small UX improvement
+- [ ] New source
+- [ ] Dashboard change
+- [ ] Docs/config change
+
+## Validation
+
+List the commands, checks, or manual validation you performed.
+
+## Screenshots
+
+If the dashboard or any visible output changed, add screenshots.
+
+## Config and Docs
+
+- [ ] No new environment variables
+- [ ] `.env.example` updated if needed
+- [ ] `README.md` updated if behavior changed
+
+## Source Additions
+
+If this PR adds a new source, explain:
+
+- why the source improves signal quality
+- whether it requires an API key
+- how it degrades when the key is missing
+- what changed in `apis/briefing.mjs` and `dashboard/inject.mjs`
+
+## Checklist
+
+- [ ] This PR stays within one bugfix or one feature family
+- [ ] I kept unrelated changes out of the diff
+- [ ] I considered security for any mixed-source content rendering
+- [ ] I tested the changed path locally