Add security policy, Dependabot, CodeQL and contributor docs

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @samiahmedsiddiqui

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,31 @@
+name: Bug report
+description: Something doesn't work as documented
+labels: [bug]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened?
+      description: What did you expect instead?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: How to reproduce
+      description: The command or code you ran, and a public URL that shows the problem if you can share one.
+      render: shell
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: check-http-status version
+      placeholder: "2.2.0"
+    validations:
+      required: true
+  - type: input
+    id: node
+    attributes:
+      label: Node.js version and OS
+      placeholder: "Node 22, macOS 15"

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/trunkcode/check-http-status/security/advisories/new
+    about: Please report security problems privately, not as a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,15 @@
+name: Feature request
+description: Suggest an idea or improvement
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do?
+      description: The problem or use case, not just the solution.
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: How could it work?

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      dev-dependencies:
+        dependency-type: development
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]

.github/pull_request_template.md

@@ -0,0 +1,10 @@
+## What and why
+
+<!-- What does this change, and what problem does it solve? Link the issue if there is one. -->
+
+## Checklist
+
+- [ ] `npm run lint`, `npm run test:types` and `npm test` pass
+- [ ] Tests added or updated for the change
+- [ ] README, types (`index.d.ts`) and `schema.json` updated if options or results changed
+- [ ] `CHANGELOG.md` updated

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: [main, v2]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:

.github/workflows/codeql.yml

@@ -0,0 +1,24 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '23 4 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (javascript-typescript)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+      - uses: github/codeql-action/analyze@v4

CONTRIBUTING.md

@@ -0,0 +1,28 @@
+# Contributing
+
+Thanks for helping out! Bug reports, ideas and pull requests are all welcome.
+
+## Development
+
+```bash
+npm install
+npm run lint
+npm run test:types
+npm test
+```
+
+Tests run against a small fake website in `test/fixtures/site.js`, so they don't need
+the network. Add a page there when a new feature needs one.
+
+## Pull requests
+
+- Keep each pull request to one change, and add or update tests for it.
+- Update the README, `index.d.ts` and `schema.json` when options or results change,
+  and add a line to `CHANGELOG.md`.
+- CI runs lint, type checks and tests on Linux, macOS and Windows with Node 20, 22
+  and 24; all of them must pass before merging.
+- Commits to `main` must be signed.
+
+## Security
+
+Please report vulnerabilities privately; see [SECURITY.md](SECURITY.md).

SECURITY.md

@@ -0,0 +1,23 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are released for the latest 2.x version. Please upgrade before
+reporting a problem in an older version.
+
+## Reporting a vulnerability
+
+Please **don't open a public issue**. Report it privately through
+[GitHub security advisories](https://github.com/trunkcode/check-http-status/security/advisories/new)
+instead.
+
+Include the version, how to reproduce the problem and what an attacker could do with
+it. You'll get a reply within a week. Once a fix is released, the advisory is
+published and you're credited unless you'd rather not be.
+
+## Scope
+
+check-http-status sends requests to the URLs you give it and to the links it finds
+on those pages. Things worth reporting include credentials (HTTP Basic auth, cloud
+upload tokens) being sent to the wrong host, and crawled content being able to run
+script in the HTML report.