From 011f108976de5c6b61eb0b2df5a6cf447350a184 Mon Sep 17 00:00:00 2001
From: Shugoki <35711149+ShugokiFable@users.noreply.github.com>
Date: Sun, 6 Sep 2026 20:32:19 -0300
Subject: [PATCH 1/3] ci: add GitHub Actions test workflow (unittest suite)

---
 .github/workflows/ci.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..7ef98d6
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${ github.ref }
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+      - name: Run test suite
+        run: python tests/run_tests.py

From d1c3b395eb850d62f7c4fc5e1b6e425bb5864097 Mon Sep 17 00:00:00 2001
From: Shugoki <35711149+ShugokiFable@users.noreply.github.com>
Date: Sun, 6 Sep 2026 20:32:20 -0300
Subject: [PATCH 2/3] docs: add SECURITY.md

---
 SECURITY.md | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..7b359e3
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,22 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please **do not open a public issue** that reveals a security problem.
+
+For anything that could put users at risk — remote code execution, credential or data exposure, unsafe downloads, or supply-chain concerns — report it privately to the owner through GitHub's private vulnerability reporting (if enabled) or by opening a **security advisory** from the repo's *Security* tab.
+
+If you are not sure whether something counts as a security issue, reporting it privately is always fine.
+
+## What happens next
+
+This is a personal, hobby-maintained project, so response is best-effort. The owner aims to:
+
+1. acknowledge the report within a few days,
+2. assess severity and impact,
+3. ship a fix on the default branch (and a tagged release when one exists),
+4. credit the reporter (only with their consent).
+
+## Supported versions
+
+Fixes land on the default branch and, where the project tags releases, in the newest release. Older tagged releases are not backported unless the issue is severe and the fix is trivial.

From a004993519d53356320baa809e2039516af01b39 Mon Sep 17 00:00:00 2001
From: Shugoki <35711149+ShugokiFable@users.noreply.github.com>
Date: Sun, 6 Sep 2026 21:28:17 -0300
Subject: [PATCH 3/3] fix(ci): restore ${{ github.ref }} concurrency expression
 (was mangled by templating)

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ef98d6..189dde3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: ci-${ github.ref }
+  group: ci-${{ github.ref }}
   cancel-in-progress: true
 
 jobs: