From c609bfb5aca36129916dd4b3763366fa748ed8f6 Mon Sep 17 00:00:00 2001
From: Dan Peterson <dan.peterson@oneidentity.com>
Date: Thu, 13 Aug 2026 15:12:18 -0600
Subject: [PATCH 1/2] Add SECURITY.md vulnerability disclosure policy

---
 SECURITY.md | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..03be5dc
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,40 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+We take the security of One Identity's Safeguard open source projects
+seriously. **Please do not report security vulnerabilities through public
+GitHub issues, pull requests, or discussions.** Use one of the private
+channels below.
+
+### Preferred: GitHub Private Vulnerability Reporting
+
+1. Open the **Security** tab of this repository.
+2. Click **Report a vulnerability**.
+3. Include the affected version(s), a description, reproduction steps,
+   and impact.
+
+This opens a private advisory visible only to you and the maintainers.
+If we confirm and fix the issue, we will credit you in the published
+GitHub Security Advisory unless you ask us not to.
+
+### Alternative: One Identity responsible disclosure
+
+You may also report through One Identity's official process at
+https://support.oneidentity.com/essentials/reporting-security-vulnerability
+(choose **Report Vulnerability**). Use this if you prefer to work through
+One Identity Support or are reporting across multiple products.
+
+## Our commitment
+
+We will acknowledge and respond to your report within **48 hours** and
+keep you informed as we investigate and work toward a fix. Please give us
+a reasonable opportunity to address the issue before any public
+disclosure.
+
+## Scope
+
+This policy covers the code in this repository. Vulnerabilities in the
+Safeguard for Privileged Passwords or Safeguard for Privileged Sessions
+appliances should be reported through One Identity's process at
+https://support.oneidentity.com/essentials/reporting-security-vulnerability.
\ No newline at end of file

From 72ff5afbae499bbfac932f7ba3e9c7dc92e62077 Mon Sep 17 00:00:00 2001
From: Dan Peterson <dan.peterson@oneidentity.com>
Date: Thu, 13 Aug 2026 15:12:20 -0600
Subject: [PATCH 2/2] Add CONTRIBUTING.md

---
 CONTRIBUTING.md | 53 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 CONTRIBUTING.md

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..3b598ef
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,53 @@
+# Contributing to PySafeguard
+
+Thanks for your interest in improving PySafeguard, the Python SDK for the
+One Identity Safeguard Web API.
+
+## Reporting issues
+
+- **Bugs and feature requests:** open a GitHub Issue.
+- **Security vulnerabilities:** do **not** open a public issue — follow
+  [SECURITY.md](SECURITY.md).
+
+## Prerequisites
+
+- [Python 3.10](https://www.python.org/downloads/) or later.
+- [Poetry](https://python-poetry.org/docs/#installation).
+- (Optional) access to a Safeguard for Privileged Passwords appliance to
+  run the integration tests.
+
+## Building
+
+    pip install poetry
+    poetry install --all-extras
+    poetry build
+
+## Testing
+
+Hermetic unit tests require no appliance:
+
+    poetry run python -m pytest tests/ -m "not integration"
+
+Integration tests **skip automatically** when `SPP_HOST` is unset. To run
+them against a lab appliance, set `SPP_HOST` (plus `SPP_USERNAME` /
+`SPP_PASSWORD`):
+
+    poetry run python -m pytest tests/ -m integration
+
+## Coding conventions
+
+    poetry run ruff check src/
+    poetry run ruff format --check src/
+    poetry run mypy src/
+
+Code must be `mypy --strict` clean. See [AGENTS.md](AGENTS.md) for the full
+conventions.
+
+## Submitting changes
+
+1. Fork the repository and create a feature branch.
+2. Keep commits focused with clear messages.
+3. Ensure `ruff check src/`, `ruff format --check src/`, `mypy src/`, and
+   `pytest tests/ -m "not integration"` pass.
+4. Open a pull request describing the behavior you changed and the tests
+   that prove it.
\ No newline at end of file