chore: move data-protection policy to SECURITY.md, untrack .claude rules

.gitignore

@@ -66,15 +66,9 @@ coverage/
 .env.local
 *.local
 
-# ACDM config — gitignored (local / path-sensitive). EXCEPT the repo-policy rules
-# below, which describe the repo / are read by repo-tooling and must travel with a
-# clone (ADR-015 "protection travels with the repo"). Process rules + acdm.json +
-# .mcp.json + CLAUDE.md stay ignored.
-.claude/*
-!.claude/rules/
-.claude/rules/*
-!.claude/rules/data-protection.md
-!.claude/rules/internal-docs-boundary.md
-!.claude/rules/publish-readiness.md
+# Claude Code / ACDM config — local development tooling (path-sensitive or
+# personal); none of it ships with the repo. The human-facing data-protection
+# policy lives in SECURITY.md.
+.claude/
 .mcp.json
 CLAUDE.md

CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to QuestionForge are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- **README — a "Development status" section** (the honest maturity framing the sibling suites carry) and a **Support** section.
+
+### Changed
+
+- **Data-protection policy moved to SECURITY.md** — a new *Data protection* section
+  states the non-negotiable "no real personal data in the repo" rule where readers
+  expect it. The three `.claude/rules/` policy files are no longer shipped;
+  `.claude/` is local development tooling and is fully git-ignored again
+  (ADR-017 marked superseded).
+- **CONTRIBUTING — sentence-case headings and a standardised licence line.** Corrected
+  documentation pointers: ADRs live in `docs/decisions/` (not `docs/adr/`), and
+  significant changes start as an issue or discussion (the repo carries no RFC folder).
+- **SECURITY — vulnerability reporting standardised** to GitHub's private vulnerability reporting link, with an aligned supported-versions table and a response-time expectation.
+
 ## [0.1.0] — First public release
 
 First public release of QuestionForge: a teacher-led, AI-assisted framework for
@@ -23,4 +41,5 @@ exporting them to QTI.
 - Methodology guides (M1–M5) and a question-format reference.
 - Getting-started and workflow documentation.
 
+[Unreleased]: https://github.com/tikankika/question-forge/compare/v0.1.0...HEAD
 [0.1.0]: https://github.com/tikankika/question-forge/releases/tag/v0.1.0

CONTRIBUTING.md

@@ -2,9 +2,27 @@
 
 Thank you for your interest in contributing to QuestionForge!
 
-## How to Contribute
+## Critical rules — data protection
 
-### Reporting Bugs
+QuestionForge reads real teaching materials (lectures, slides, course documents).
+This is a public repository — never let real personal data into the repo, in code,
+tests, comments, documentation, examples or commit messages. Git history is permanent.
+
+- **Never commit real personal data:** names (students, colleagues, teachers),
+  school or institution names, identifying places, personal-identity numbers, file
+  paths containing a username (`/Users/...`), secrets (API keys, tokens, `.env`),
+  and real course materials that identify people or institutions.
+- **Use fabricated or anonymised data in every example and test** — for example
+  `School A`, `Colleague_A`, `/path/to/project`, a fake course code.
+- **Watch quasi-identifiers:** a class plus a date plus a subject can identify a
+  student even with no name attached.
+- **Already committed something real?** Deleting the file is not enough — it stays
+  in the git history forever. Stop, scrub the history, rotate any exposed secret,
+  and escalate before the next push.
+
+## How to contribute
+
+### Reporting bugs
 
 1. Check if the bug is already reported in [Issues](https://github.com/tikankika/question-forge/issues)
 2. If not, create a new issue with:
@@ -13,15 +31,15 @@ Thank you for your interest in contributing to QuestionForge!
    - Expected vs actual behaviour
    - Environment (OS, Python/Node version, Claude Desktop version)
 
-### Suggesting Features
+### Suggesting features
 
 1. Open an issue with the `enhancement` label
 2. Describe the use case and proposed solution
-3. Reference relevant ADRs or RFCs if applicable
+3. Reference relevant ADRs (`docs/decisions/`) if applicable
 
-### Code Contributions
+### Code contributions
 
-#### Setup Development Environment
+#### Setup development environment
 
 ```bash
 # Clone your fork
@@ -39,15 +57,15 @@ cd ../qf-scaffolding
 npm install
 ```
 
-#### Development Workflow
+#### Development workflow
 
-1. **Check existing ADRs** in `docs/adr/` for architectural context
-2. **Create RFC** for significant changes (see `docs/rfcs/` for examples)
+1. **Check existing ADRs** in `docs/decisions/` for architectural context
+2. **Open an issue or discussion first** for significant changes, so the approach can be agreed before you build
 3. **Write tests** for new functionality
 4. **Follow code style** (see below)
 5. **Update documentation** if needed
 
-#### Code Style
+#### Code style
 
 **Python (qf-pipeline, qti-core):**
 - Follow PEP 8
@@ -59,7 +77,7 @@ npm install
 - Explicit types (avoid `any`)
 - JSDoc for public functions
 
-#### Commit Messages
+#### Commit messages
 
 Follow conventional commits:
 
@@ -74,15 +92,15 @@ refactor(step3): simplify fix rule matching
 
 Types: `feat`, `fix`, `docs`, `refactor`, `test`, `chore`
 
-#### Pull Request Process
+#### Pull request process
 
 1. Update documentation if needed
 2. Add tests for new functionality
 3. Ensure all tests pass
 4. Reference related issues in PR description
 5. Request review
 
-### Documentation Contributions
+### Documentation contributions
 
 Documentation improvements are always welcome:
 
@@ -91,24 +109,23 @@ Documentation improvements are always welcome:
 - Improve getting started guide
 - Translate to other languages
 
-## Architecture Overview
+## Architecture overview
 
 Before contributing code, familiarise yourself with:
 
-- **ADR-001**: Two-MCP architecture (qf-scaffolding + qf-pipeline)
-- **ADR-014**: Shared session management
-- **docs/rfcs/**: Design proposals and specifications
-- **WORKFLOW.md**: Complete workflow documentation
+- **README.md**: the two-MCP architecture (qf-scaffolding + qf-pipeline)
+- **WORKFLOW.md**: complete workflow documentation
+- **docs/decisions/**: architecture decision records (ADRs)
 
 ## Communication
 
 - **Issues**: Bug reports and feature requests
 - **Discussions**: Questions and ideas
 - **Pull Requests**: Code contributions
 
-## License
+## Licence
 
-By contributing, you agree that your contributions will be licensed under PolyForm Noncommercial 1.0.0.
+By contributing, you agree that your contributions will be licensed under PolyForm Noncommercial 1.0.0 (see [LICENSE](LICENSE)).
 
 ---