Docs(community): route security, conduct and support reports to the right channels

SECURITY.md used to ask for vulnerability reports in public issues while
requesting no public disclosure in the same breath; it now points at
GitHub's private advisory form, states the latest-release-only support
policy and scopes out non-code findings. The Code of Conduct's
enforcement contact — a literal blank since the file landed — now uses
the same private form. New SUPPORT.md and an issue-chooser config send
questions to Discussions Q&A and docs before they become issues, and
CONTRIBUTING drops its stale "questions also go to Issues" line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: true
+contact_links:
+  - name: 📖 Documentation
+    url: https://docs.ipcheck.ing
+    about: Deployment, MaxMind setup, environment variables, and how each tool works.
+  - name: 💬 Questions & help
+    url: https://github.com/jason5ng32/MyIP/discussions/categories/q-a
+    about: Setup help, "why does my result look like this", and anything that isn't a bug.
+  - name: 🔒 Report a security vulnerability
+    url: https://github.com/jason5ng32/MyIP/security/advisories/new
+    about: Private report, visible only to the maintainer. Please don't open a public issue.

CODE_OF_CONDUCT.md

@@ -59,8 +59,12 @@ representative at an online or offline event.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-.
+reported privately to the maintainer using GitHub's
+[private report form](https://github.com/jason5ng32/MyIP/security/advisories/new)
+— it reaches only the maintainer; start the report with "Code of Conduct" so it
+isn't triaged as a security issue. Behavior that violates
+[GitHub's own terms](https://github.com/contact/report-abuse) can also be
+reported to GitHub directly.
 All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the

CONTRIBUTING.md

@@ -98,8 +98,10 @@ ships as `beta` until it's complete. Full walkthrough: **[TRANSLATING.md](TRANSL
 
 Use the issue templates in [`.github/ISSUE_TEMPLATE/`](.github/ISSUE_TEMPLATE/) —
 one for bug reports (include terminal / browser console logs) and one for feature
-requests. For general questions, GitHub Issues is also the right place; there are
-no chat channels.
+requests. Questions, setup help, and "is this a bug?" go to
+[Discussions → Q&A](https://github.com/jason5ng32/MyIP/discussions/categories/q-a)
+instead — see [SUPPORT.md](SUPPORT.md). Security vulnerabilities go through the
+private channel in [SECURITY.md](SECURITY.md), never a public issue.
 
 ## Testing
 

SECURITY.md

@@ -1,26 +1,46 @@
-## Reporting a Vulnerability
+# Security Policy
 
-The security of our project is a top priority. If you discover a security vulnerability, we encourage you to report it directly through our GitHub Issues.
+## Supported versions
 
-### How to Report a Vulnerability
+Only the latest release gets security fixes. Older tags are not patched — if you
+self-host, upgrade before reporting.
 
-1. **Report Through GitHub Issues**: Please create a new issue in our [GitHub Issues page](https://github.com/jason5ng32/MyIP/issues). Provide a clear and detailed description of the potential vulnerability. Include steps to reproduce it, if possible.
+## Reporting a vulnerability
 
-2. **Avoid Public Disclosure**: To protect the community, please do not disclose the vulnerability publicly until we have had a chance to address it.
+**Report privately, not through a public issue.** Use GitHub's private reporting form:
 
-3. **Response Time**: We aim to respond to security issue reports within 48 hours, acknowledging receipt.
+**[Report a vulnerability →](https://github.com/jason5ng32/MyIP/security/advisories/new)**
 
-4. **Updates**: We will keep you informed about our progress on the issue through the GitHub Issues thread.
+It's visible only to the maintainer, and it's the right channel even if you're unsure
+whether what you found is a real issue.
 
-5. **Credit**: We value your contribution to the security of this project. We will acknowledge your efforts in the GitHub Issue thread and in our release notes, if a fix is implemented.
+Helpful things to include:
 
-## Security Update Process
+- What an attacker can do with it, and what they'd need to start (a session? just a URL?).
+- Steps to reproduce — a request, a payload, or a short script.
+- Where the problem lives: front-end (`frontend/`), API handler (`api/`), or shared
+  code (`common/`).
+- Whether you hit it on [ipcheck.ing](https://ipcheck.ing) or your own deployment, and
+  the version if self-hosted.
 
-Upon receiving a report of a vulnerability, our team will:
+## What to expect
 
-- Promptly investigate the issue.
-- Develop a fix and test it thoroughly.
-- Release an updated version that addresses the issue.
-- Provide updates and patches as needed.
+- An acknowledgement within a few days.
+- A fix in the next release once it's confirmed, or an explanation if it turns out to be
+  out of scope.
+- Credit in the release notes and the advisory, unless you'd rather stay anonymous.
 
-Thank you for helping us keep our project safe and secure.
+Please hold off on public disclosure until a fix ships.
+
+## Out of scope
+
+- **Findings against [ipcheck.ing](https://ipcheck.ing) infrastructure** rather than this
+  codebase — rate limits, TLS configuration, DNS, hosting. Report those the same way, but
+  they aren't code issues.
+- **Third-party data providers.** MyIP queries external IP-geolocation and network APIs;
+  their vulnerabilities belong to them.
+- **Automated scanner output** with no working proof of concept.
+- **Missing optional hardening in a self-hosted instance.** `ALLOWED_DOMAINS` and the
+  other environment settings are documented in the
+  [Developer Guide](https://docs.ipcheck.ing/developer) — an instance running without them
+  is misconfigured, not vulnerable.

SUPPORT.md

@@ -0,0 +1,41 @@
+# Getting help
+
+Start with the docs, then pick the channel that matches what you need.
+
+## Documentation first
+
+The **[MyIP Docs Center](https://docs.ipcheck.ing)** covers most questions, in English,
+中文, français and русский:
+
+- **[Developer Guide](https://docs.ipcheck.ing/developer)** — deployment (Node, Docker,
+  Vercel), MaxMind setup, reverse proxies and `ALLOWED_DOMAINS`, environment variables,
+  architecture.
+- **[Knowledge Base](https://docs.ipcheck.ing/knowledge-base)** — what each tool measures
+  and how to read its results.
+
+Two settings account for most self-hosting problems: MaxMind credentials (without them
+the MaxMind source returns 503) and `ALLOWED_DOMAINS` (without it every request from a
+non-localhost domain gets 403).
+
+## Where to ask
+
+| You want to… | Go to |
+|---|---|
+| Ask how to do something, or why a result looks odd | [Discussions → Q&A](https://github.com/jason5ng32/MyIP/discussions/categories/q-a) |
+| Report a bug you can reproduce | [New issue → Bug report](https://github.com/jason5ng32/MyIP/issues/new?template=bug_report.md) |
+| Suggest a feature | [New issue → Feature request](https://github.com/jason5ng32/MyIP/issues/new?template=feature_request.md) |
+| Report a security vulnerability | [Private advisory](https://github.com/jason5ng32/MyIP/security/advisories/new) — see [SECURITY.md](SECURITY.md) |
+| Contribute code or a translation | [CONTRIBUTING.md](CONTRIBUTING.md) · [TRANSLATING.md](TRANSLATING.md) |
+
+There are no chat channels — everything happens on GitHub, in the open, so the next
+person with the same question can find the answer.
+
+## Making your question answerable
+
+Deployment questions need: how you're running it (Docker / Node / Vercel), the version,
+what you set for `ALLOWED_DOMAINS` and MaxMind, and the backend terminal output.
+Page questions need: browser, what you saw versus what you expected, and any errors from
+the browser console.
+
+MyIP is maintained by one person in their spare time. Replies aren't instant, and a
+question that already contains the details above gets answered a lot sooner.