Add CONTRIBUTING.md and SECURITY.md; update LICENSE and README.md for clarity

CONTRIBUTING.md

@@ -0,0 +1,47 @@
+# Contributing
+
+Thanks for contributing to Sharprompt.
+
+## Development Environment
+
+- .NET 8 SDK
+- A terminal that supports interactive console applications
+
+## Setup
+
+```sh
+dotnet restore
+dotnet build -c Release
+dotnet test -c Release
+```
+
+The example project can be run with:
+
+```sh
+dotnet run --project Sharprompt.Example
+```
+
+## Before Opening a Pull Request
+
+Please make sure the following commands succeed locally:
+
+```sh
+dotnet build -c Release
+dotnet test -c Release --no-build
+dotnet format --verify-no-changes --verbosity detailed --no-restore
+```
+
+## Contribution Guidelines
+
+- Keep changes focused on a single problem or feature.
+- Add or update tests when behavior changes.
+- Update the README or examples when public APIs or user-facing behavior change.
+- Prefer small, reviewable pull requests.
+
+## Pull Requests
+
+- Describe the motivation for the change.
+- Summarize the behavior change clearly.
+- Link related issues when applicable.
+
+By submitting a contribution, you agree that your work will be released under the MIT License used by this repository.

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2019 shibayan
+Copyright (c) 2019-2026 Tatsuro Shibamura
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -250,6 +250,14 @@ var city = Prompt.Select<string>(o => o.WithMessage("Select your city")
 - macOS
   - Terminal.app
 
+## Contributing
+
+Please see [CONTRIBUTING.md](CONTRIBUTING.md) for local setup, validation commands, and pull request expectations.
+
+## Security
+
+Please see [SECURITY.md](SECURITY.md) for how to report vulnerabilities privately.
+
 ## License
 
 This project is licensed under the [MIT License](https://github.com/shibayan/Sharprompt/blob/master/LICENSE)

SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are provided for the latest code on the `master` branch and the latest package published to NuGet.
+
+Older versions may receive fixes at the maintainer's discretion, but support is not guaranteed.
+
+## Reporting a Vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues.
+
+Send a report to `me@shibayan.jp` with the following information when possible:
+
+- A short description of the issue
+- Affected versions
+- Reproduction steps or a proof of concept
+- Impact assessment
+- Any suggested remediation
+
+You can write in either Japanese or English.
+
+Reports will be reviewed as quickly as possible. Initial triage is typically performed within 5 business days.
+
+After the report is validated, the maintainer will coordinate a fix and decide on disclosure timing. Public disclosure before a fix is available may put users at risk, so please allow time for remediation.

Sharprompt.SourceGenerator/Sharprompt.SourceGenerator.csproj

@@ -7,10 +7,13 @@
     <EnforceExtendedAnalyzerRules>true</EnforceExtendedAnalyzerRules>
     <IsRoslynComponent>true</IsRoslynComponent>
     <IsPackable>false</IsPackable>
+    <PublishRepositoryUrl>true</PublishRepositoryUrl>
+    <EmbedUntrackedSources>true</EmbedUntrackedSources>
   </PropertyGroup>
 
   <ItemGroup>
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.0.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.SourceLink.GitHub" Version="10.0.103" PrivateAssets="all" />
   </ItemGroup>
 
 </Project>

Sharprompt/Sharprompt.csproj

@@ -11,18 +11,25 @@
     <PackageId>Sharprompt</PackageId>
     <PackageIcon>icon.png</PackageIcon>
     <PackageReadmeFile>README.md</PackageReadmeFile>
+    <PackageProjectUrl>https://github.com/shibayan/Sharprompt</PackageProjectUrl>
     <PackageReleaseNotes>https://github.com/shibayan/Sharprompt/releases/tag/v$(Version)</PackageReleaseNotes>
     <PackageLicenseExpression>MIT</PackageLicenseExpression>
     <PackageTags>cli;command-line;console;interactive;prompt;terminal</PackageTags>
+    <PublishRepositoryUrl>true</PublishRepositoryUrl>
     <RepositoryUrl>https://github.com/shibayan/Sharprompt</RepositoryUrl>
     <RepositoryType>git</RepositoryType>
+    <EmbedUntrackedSources>true</EmbedUntrackedSources>
   </PropertyGroup>
 
   <ItemGroup>
     <None Include="..\icon.png" Pack="true" PackagePath="\" />
     <None Include="..\README.md" Pack="true" PackagePath="\" />
   </ItemGroup>
 
+  <ItemGroup>
+    <PackageReference Include="Microsoft.SourceLink.GitHub" Version="10.0.103" PrivateAssets="all" />
+  </ItemGroup>
+
   <ItemGroup>
     <Compile Update="Strings\Resource.Designer.cs">
       <DesignTime>True</DesignTime>