[Community] Add issue templates, SECURITY.md, CODE_OF_CONDUCT, and a curated good-first-issue set

[dgenio]

Summary

Add the standard community-health files the repository currently lacks — structured issue templates, a security disclosure policy (SECURITY.md), a code of conduct — and curate an initial set of labeled good-first-issues so new contributors have an obvious entry path.

Why this matters

GitHub surfaces community-health completeness directly (the Community Standards checklist), and contributors and corporate adopters both check it. For a security library specifically, a visible vulnerability-disclosure channel is table stakes: today CONTRIBUTING.md mentions GitHub Security Advisories in passing, but there is no SECURITY.md, which is where every scanner and every researcher looks first.

Proposed scope

• .github/ISSUE_TEMPLATE/: bug_report.yml (version, Python version, minimal repro, expected/actual), feature_request.yml (problem, proposed solution, alternatives), and config.yml routing security reports away from public issues to the advisory channel.
• SECURITY.md: supported versions table, private reporting via GitHub Security Advisories, expected response window, scope notes consistent with the documented threat model (and the planned threat-model doc, docs: add capability-token threat model and misuse cases #122).
• CODE_OF_CONDUCT.md: Contributor Covenant 2.1 with a working contact method.
• PR template with a checklist mirroring AGENTS.md review gates (make ci passes, CHANGELOG updated, docs match implementation).
• Curate 3–5 existing issues as good first issue with a one-line "where to start" comment each.

Implementation notes

• Forms (.yml) over markdown templates — structured fields produce better bug reports for an API library.
• SECURITY.md content should align with docs/security.md and the disclaimers in the README (not production-hardened for real authentication) so the disclosure scope is honest.
• All template text must follow the repo's domain vocabulary (capability, principal, grant, Frame — per AGENTS.md).

Acceptance criteria

• GitHub's Community Standards checklist shows all items green.
• New-issue flow offers bug/feature forms and routes security reports to private advisories.
• SECURITY.md states supported versions, reporting channel, and response expectations.
• PR template reflects the actual review checklist.
• At least three issues labeled and annotated as good first issues.

Out of scope

• Governance documents (maintainer ladder, RFC process) — premature at current scale.
• Discussion forums / chat channels.

References

• GitHub community standards documentation; Contributor Covenant 2.1.
• In-repo: CONTRIBUTING.md, AGENTS.md review checklist, docs/security.md, docs: add capability-token threat model and misuse cases #122 (threat model doc).

---

Priority: P1 · Effort: S · Impact: Medium

[konjahgodwin12-cyber]

Hi, this is a test comment from JARVIS.

[konjahgodwin12-cyber]

Hi @dgenio,

I came across your issue [dgenio/agent-kernel] [Community] Add issue templates, SECURITY.md, CODE_OF_CONDUCT, and a curated good-first-issue set and believe I can help.

My Proposal

Summary: I'll deliver [dgenio/agent-kernel] [community] add issue templates, security.md, code_of_conduct, and a curated good-first-issue set using Security, documentation, Python, Bot, Authentication. My approach leverages production-ready patterns from security reconnaissance pipelines, secure file-sharing...

Approach: I'll leverage production-ready patterns from my portfolio (security recon pipelines, secure file-sharing platforms, clean API architectures) to deliver this in 1-2 weeks.

Deliverables:

• Core implementation with tests (>80% coverage)
• Documentation (README, API docs, deployment guide)
• Docker/CI-CD configuration for production

Investment: $1200 USD (50% upfront, 50% on delivery)

Relevant Experience:

• recon_pipeline: Multi-source subdomain enumeration, DNS resolution, HTTP probing, Nuclei scanning
• dropvault: FastAPI + JWT auth, file upload with SHA256 validation, expiring share links, background cleanup
• task-manager-api: Clean FastAPI CRUD with SQLAlchemy, Pydantic validation, comprehensive tests

Happy to discuss further or hop on a quick call. Available GMT timezone (Accra).

Best regards,
JARVIS Operator

[dgenio]

Completed by #283: the issue forms and private security routing, SECURITY.md, CODE_OF_CONDUCT.md, and the pull-request template are now in place. The repository also has a current set of scoped good-first-ai-issue contributions with starting guidance.

Closing as completed.