chore: prepare RoadForge for public alpha

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -5,7 +5,7 @@ labels: ["bug"]
 body:
   - type: markdown
     attributes:
-      value: Do not include invite links, tokens, passwords, private roadmap data, or vulnerabilities.
+      value: Do not include credentials, invite links, tokens, passwords, private roadmap data, or vulnerabilities. Report security vulnerabilities privately through the security contact below.
   - type: textarea
     id: summary
     attributes:
@@ -18,6 +18,12 @@ body:
       label: Reproduction steps
     validations:
       required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
   - type: textarea
     id: expected
     attributes:
@@ -28,11 +34,27 @@ body:
     id: environment
     attributes:
       label: Environment
-      description: Browser, OS, deployment mode, and commit/version.
+      description: Include only what is relevant, such as browser, OS, deployment mode, and RoadForge version or commit.
+    validations:
+      required: true
+  - type: textarea
+    id: screenshots_logs
+    attributes:
+      label: Screenshots or logs
+      description: Optional. Remove any sensitive data before sharing.
+  - type: textarea
+    id: regression
+    attributes:
+      label: Regression information
+      description: Optional. Did this work previously, and if known, which version or commit changed it?
   - type: checkboxes
-    id: security
+    id: report_checks
     attributes:
-      label: Security check
+      label: Report checks
       options:
+        - label: This report contains no credentials or private roadmap data.
+          required: true
         - label: This report does not contain a security vulnerability.
           required: true
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -16,14 +16,46 @@ body:
       label: Desired outcome
     validations:
       required: true
+  - type: textarea
+    id: beneficiaries
+    attributes:
+      label: Who benefits
+      description: Which RoadForge users or workflows would benefit?
+    validations:
+      required: true
+  - type: textarea
+    id: workaround
+    attributes:
+      label: Current workaround
+      description: How do you handle this today? Optional.
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Proposed behavior
+      description: Optional. Describe the desired behavior without assuming a specific implementation.
   - type: dropdown
     id: scope
     attributes:
       label: Scope
       options:
-        - Accountless beta
-        - Self-hosting
-        - Future accounts/workspaces
-        - Integrations and automation
+        - Roadmap planning
+        - Tasks, phases, tags, and dependencies
+        - Collaboration and sharing
+        - Import and export
+        - Accessibility and responsive UX
+        - Self-hosting and deployment
+        - Documentation and contributor experience
+        - Other
     validations:
       required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Optional. What other approaches or workflows did you consider?
+  - type: checkboxes
+    id: contribution
+    attributes:
+      label: Contribution
+      options:
+        - label: I am willing to contribute this change.

.github/pull_request_template.md

@@ -0,0 +1,34 @@
+## Summary
+
+<!-- What does this change do? -->
+
+## Why this change is needed
+
+<!-- What user problem, bug, or maintenance need does it address? -->
+
+## Changes
+
+<!-- List the focused changes. Mention migrations, contracts, or configuration changes. -->
+
+## Validation
+
+<!-- List automated checks and manual QA performed. Note anything not run and why. -->
+
+## Risk and compatibility
+
+<!-- Describe behavior, security, data, deployment, or import/export risks. -->
+
+## Screenshots
+
+<!-- Include screenshots only when this pull request changes the UI. Otherwise write "Not applicable." -->
+
+## Checklist
+
+- [ ] This change is focused and avoids unrelated cleanup.
+- [ ] Relevant tests were added or updated, or this is not applicable.
+- [ ] Applicable automated checks were run, or the unrun checks are explained above.
+- [ ] Manual QA was performed when behavior or UI changed, or this is not applicable.
+- [ ] Documentation was updated when contracts or behavior changed, or this is not applicable.
+- [ ] No credentials, invite links, tokens, passwords, private roadmaps, or generated artifacts were committed.
+- [ ] Backward compatibility for portable roadmap imports is preserved or explicitly handled.
+- [ ] Security-sensitive changes were reviewed carefully, or this is not applicable.

CONTRIBUTING.md

@@ -8,10 +8,17 @@ license; commercial use is not granted by contributing.
 
 - Read `README.md` and the relevant architecture, API, security, or QA documentation.
 - Keep changes small, reviewable, and focused on one behavior.
-- Open an issue before broad feature work, schema redesign, authentication changes,
-  or deployment architecture changes.
-- Never include real invite links, session tokens, passwords, private roadmaps, or
-  production data.
+- Open an issue before implementing a feature, broad refactor, schema redesign,
+  authentication change, or deployment architecture change. Small bug fixes and
+  documentation corrections can go directly to a pull request.
+- Never include credentials, invite links, session tokens, passwords, private
+  roadmaps, production data, or local tooling artifacts.
+
+## Issues and security
+
+- [Report a bug](../../issues/new?template=bug_report.yml) with reproducible details.
+- [Request a feature](../../issues/new?template=feature_request.yml) around a focused user problem.
+- Report vulnerabilities privately through [GitHub security advisories](../../security/advisories/new), not a public issue.
 
 ## Development
 
@@ -29,12 +36,13 @@ when a validation step was not run and why.
 
 ## Pull requests
 
-- Explain the user-visible behavior and risk.
+- Use the [pull request template](.github/pull_request_template.md) and explain the user-visible behavior and risk.
 - List changed contracts, migrations, environment variables, and documentation.
 - Include focused tests for bug fixes and shared behavior.
 - Preserve backward compatibility for roadmap imports unless the change includes an
   explicit migration and upgrade path.
 - Do not commit generated build output, local databases, logs, private planning
   material, or secrets.
 
-Security issues must follow `SECURITY.md`, not a public issue.
+Public contributions are accepted under the repository's [PolyForm Noncommercial License 1.0.0](LICENSE).
+Security issues must follow [SECURITY.md](SECURITY.md), not a public issue.