Release Package Tools 0.1.0

public/SECURITY.md

@@ -0,0 +1,12 @@
+# Security
+
+Report vulnerabilities privately through the repository owner on the Gitea
+instance. Do not attach confidential packages to a public issue.
+
+Package Tools processes untrusted archives locally. Its main controls are
+source/entry/count/expansion limits, strict CRC and overlap checks before
+extracting a selected entry, path normalization and collision diagnostics,
+DTD/entity rejection, bounded JSON parsing, no script execution, and no remote
+reference resolution. A browser or dependency decoder vulnerability remains
+outside the guarantees of the application; keep dependencies and browsers
+current.