docs: CONTRIBUTING.md and SECURITY.md

CHANGELOG.md

@@ -78,6 +78,7 @@
 - Build: chiaki's build script starts the native build clean when chiaki's build files change. The OpenSSL upgrade otherwise failed on a machine that had built before (old configured headers left in the cache).
 
 ## Unreleased
+- CONTRIBUTING.md: how to report problems, build, and send changes (one topic per pull request, CHANGELOG in each, lint and CI, the chiaki-ng submodule, no game pictures or secrets, licences). SECURITY.md: report privately through GitHub's security advisories, and what MoonCast keeps where.
 - README: rewritten for MoonCast (it was still Moonlight's). It covers what the two apps play and how, the features, install and Sunshine's gamepad setting, building with the chiaki-ng submodule, the licences and the credits.
 
 ## 12.2-test227 (2026-10-21)

CONTRIBUTING.md

@@ -0,0 +1,39 @@
+# Contributing to MoonCast
+
+Thanks for helping! A few rules keep the history easy to follow and the apps easy to release.
+
+## Reporting a problem
+
+Use **New issue → Something doesn't work**. Say:
+- which app (MoonCast or MoonCast TV) and which version (Settings, About);
+- your device and Android version;
+- what you played (PC, PS5 or Xbox), at home or away;
+- what happened.
+
+A screenshot or a short video helps a lot. For ideas, use **Idea or wish**.
+
+Security problems go privately, not in an issue: see [SECURITY.md](SECURITY.md).
+
+## Building
+
+See [Building](README.md#building) in the README. Clone with `--recurse-submodules`: the PS5 part is built from `third-party/chiaki-ng`.
+
+## Changes
+
+- **One topic per branch and pull request.** A fix and a feature are two pull requests. Name branches by kind and topic: `fix/battery-res`, `feat/fsr`, `docs/readme`.
+- **CHANGELOG.md in every pull request.** Add an entry at the top that says what changed for someone using the app, in plain words. Then add what changed in the code.
+- **Match the code around you.** Use the same naming, comment style and amount of comments. Keep it simple: no new libraries or abstractions without a reason.
+- **Both apps.** Settings and behaviour that make sense on TVs and handhelds go into both (`src/tv` and `src/handheld`); shared code lives in `src/main`.
+- **Lint and CI must pass.** CI builds both apps and runs lint on every pull request. Locally: `./gradlew lintNonRootHandheldDebug lintNonRootTvDebug`.
+- **Test on a device** before asking for review, and say in the pull request what you tested, on which device, and what you couldn't test.
+- **PS5 native code** lives in [MoonCastDev/chiaki-ng-mooncast](https://github.com/MoonCastDev/chiaki-ng-mooncast). Change it there first, then move the `third-party/chiaki-ng` submodule to the new commit in your pull request.
+- **No copyrighted game pictures** in the repository (screenshots, box art, mockups). Use made-up scenes, or free games.
+- **No secrets.** Never commit keys, passwords, tokens, sign-in data or `keystore.properties`.
+
+## Test builds
+
+Put the build name in the version: `BUILD=test123 ./gradlew assembleNonRootHandheldDebug assembleNonRootTvDebug` gives `1.0-test123`. Pre-releases on GitHub carry these test builds; releases are signed with the MoonCast key, built with `scripts/release.sh`.
+
+## Licence
+
+MoonCast is GPL-3.0, with the parts from chiaki-ng (PS5) and XStreaming (Xbox) under AGPL-3.0. By contributing, you agree that your work is published under the same licences. When you add a library, also add it to `app/src/main/java/com/limelight/home/Licences.kt`, to `NOTICE`, and add its licence text to `app/src/main/assets/licences/`.

SECURITY.md

@@ -0,0 +1,16 @@
+# Security
+
+MoonCast handles pairing with your PC, and sign-ins to PlayStation Network and Xbox. If you find a way to get at
+someone's pairing, sign-in or console, or a way into MoonCast or the devices it talks to, please report it **privately**:
+
+- **[Report a vulnerability](https://github.com/MoonCastDev/moonlight-android/security/advisories/new)** (GitHub's private security advisory). Only the maintainers see it.
+
+Please don't open a public issue for it. Include what you found, how to reproduce it, and which version (Settings, About).
+We'll reply as soon as we can and agree with you on when the fix and the report are made public.
+
+What MoonCast keeps, and where:
+- **PC pairing certificates:** stay on the device. When you send a game to a MoonCast TV, they go to that TV for the session only, encrypted, over your own network.
+- **PlayStation Network and Xbox sign-ins, and a PS5's registration:** stay on your own devices (moving a game to your MoonCast TV hands what it needs to that TV, over your own network) and go only to Sony and Microsoft.
+- **Release builds:** signed with the MoonCast key (certificate SHA-256 `ac7cce06b53c84cdfdaf7f05c29479e332b434bd5799dc5716cba632173dff07`). Don't install a "MoonCast" signed with anything else.
+
+Supported versions: the latest release and the latest beta.