add CONTRIBUTING and SECURITY file

- Mention that we accept only security-related contributions
- Mention how to report security vulnerabilities

Author: yaperez-anssi

CONTRIBUTING.md

@@ -0,0 +1,40 @@
+# Contributing to This Project
+
+Thank you for your interest in this project. Please read this document
+carefully before considering any contributions.
+
+## Scope of Contributions
+
+This project only accepts contributions related to security maintenance. No
+other types of contributions are expected or will be accepted at this time.
+
+## Support Policy
+
+Thank you for understanding and respecting the limited scope of this project's
+contributions and support. In particular, there is no commitment regarding
+processing times.
+
+### Limited Support Scope
+
+- Support is provided exclusively to contributors working on security-related
+  improvements.
+- The project maintainers will only assist with issues directly related to your
+  security maintenance contributions.
+
+### No General Support
+
+- We do not offer general support for using or setting up the project.
+- Questions, feature requests, or issues unrelated to active security
+  maintenance contributions will not be addressed.
+
+## How to Contribute
+
+1. Ensure your contribution is strictly related to security maintenance.
+2. Fork the repository and create a new branch for your work.
+3. Submit a pull request with a clear description of your security-related
+   improvements.
+
+## Security Vulnerabilities
+
+If you discover a security vulnerability, please report it according to our
+security policy outlined in the [`SECURITY.md`](SECURITY.md).

SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please help us
+address it responsibly by following these steps:
+
+1. **Do not publicly disclose the vulnerability.**
+2. Contact us directly at
+   [opensource@ssi.gouv.fr](mailto:opensource@ssi.gouv.fr) with the following
+   details:
+   - A clear description of the issue.
+   - Steps to reproduce the vulnerability.
+   - Any potential impact or exploit scenarios.
+
+Thank you for helping us keep this project secure!