Initial Minecraft Renew Mod workspace

docs/security-review.md

@@ -0,0 +1,55 @@
+# Security Review
+
+## Scope
+
+Project:
+
+```text
+minecraft-renew-mod / create-limited-draining
+```
+
+Reviewed version or commit:
+
+```text
+Unreleased workspace state
+```
+
+## Code Patterns Checked
+
+- [ ] No `eval`.
+- [ ] No dynamic `Function` constructor.
+- [ ] No unsafe HTML injection.
+- [ ] No unexpected shell execution.
+- [ ] No unexpected external network calls.
+- [ ] No secrets committed.
+- [ ] No unsafe file writes outside expected Gradle/Minecraft runtime paths.
+
+## Dependency Review
+
+Command:
+
+```powershell
+cd create-limited-draining
+.\gradlew dependencies --configuration runtimeClasspath
+```
+
+Result:
+
+```text
+Completed successfully on 2026-05-15. Gradle resolved runtimeClasspath and reported the expected NeoForge, Create, Ponder, Flywheel, and Registrate dependency tree.
+```
+
+## Runtime Review
+
+- [ ] Least-privilege runtime configuration.
+- [ ] External dependency repositories documented in Gradle.
+- [ ] Local Minecraft run data is ignored.
+- [ ] Sensitive data is not persisted unless explicitly required.
+
+## Release Notes
+
+Known residual risks:
+
+```text
+In-game Hose Pulley behavior still needs manual world testing before publication.
+```