docs: add structured issue intake and security reporting guidance (#2054)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,71 @@
+name: Bug report
+description: Report a reproducible problem in FilmCraft.
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please report one problem per issue and search existing issues first.
+        For security vulnerabilities, follow [SECURITY.md](https://github.com/storytold/filmcraft/blob/main/SECURITY.md) instead of posting sensitive details here.
+  - type: input
+    id: version
+    attributes:
+      label: FilmCraft version or commit
+      description: Copy the version from Help > About FilmCraft, or give the commit if built from source.
+      placeholder: "0.8.0"
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Operating system and architecture
+      placeholder: "Windows 11 x64, macOS 15 Apple silicon, Ubuntu 24.04 x86_64, or browser and version"
+    validations:
+      required: true
+  - type: dropdown
+    id: build
+    attributes:
+      label: Installation type
+      options:
+        - Official installer
+        - Portable archive or AppImage
+        - Flatpak
+        - Web app
+        - Built from source
+        - Other or unknown
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Start from opening a project. Include the panel, tool, menu item, or command used.
+      placeholder: |
+        1. Open or create...
+        2. Select...
+        3. Observe...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Include any error message and whether it happens every time.
+    validations:
+      required: true
+  - type: textarea
+    id: document
+    attributes:
+      label: Media, sequence, export, and hardware details
+      description: If relevant, include container/codec, resolution, frame rate, bit depth/HDR, sequence settings, export preset, GPU/driver, and hardware decoding or encoding settings.
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Screenshots, logs, or a minimal sample
+      description: Optional. Remove secrets, personal paths, and private project or media content. Attach only files you have permission to share; do not attach malicious files.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/storytold/filmcraft/blob/main/SECURITY.md
+    about: Read the reporting guidance before sharing sensitive details or malicious files.
+  - name: Community help
+    url: https://discord.gg/artcraft
+    about: Ask usage questions and discuss FilmCraft workflows with the community.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,33 @@
+name: Feature request
+description: Suggest an improvement to a FilmCraft workflow.
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please search existing issues and describe one feature per request.
+        For usage questions, visit the [community chat](https://discord.gg/artcraft).
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem or workflow
+      description: What are you trying to accomplish, and what gets in the way?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Requested behavior
+      description: Describe how the feature would work from the user's point of view.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives or workarounds
+      description: What have you tried, and where does it fall short?
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Optional examples, related issues, or your platform/version if relevant. Share only material you have permission to publish.

SECURITY.md

@@ -0,0 +1,37 @@
+# Security policy
+
+FilmCraft processes untrusted media, projects, interchange files, fonts and presets,
+and provides CLI, control-channel and MCP automation. Security reports about those
+inputs, automation boundaries, dependencies or release artifacts are welcome.
+
+## Reporting a vulnerability
+
+GitHub private vulnerability reporting is not currently enabled for this repository,
+and no dedicated private security address is documented. Contact the maintainers
+through the [project's existing community channels](https://discord.gg/artcraft)
+with a minimal, non-exploitable description and ask for a private transfer method.
+Do not publish a working exploit, malicious attachment, credential, private project,
+or sensitive crash dump in a public issue or chat. Wait for a private channel before
+sharing those details; if none is established, withhold sensitive material.
+
+A useful report includes the FilmCraft version or commit, operating system and
+architecture, affected component, impact, reproduction steps, and any workaround.
+For media or project parsing problems, initially describe the file format, size,
+cryptographic hash and whether the sample is synthetic or privately owned. Remove
+personal paths, credentials and unrelated project content from logs. Coordinate
+sample transfer with a maintainer instead of uploading a malicious file publicly.
+
+Please allow maintainers time to investigate and coordinate a fix before disclosing
+exploitable details. This policy does not promise a response deadline or a particular
+supported-version window. Include the exact affected version and, when safe to do
+so, whether the problem also occurs on the latest release.
+
+## Regression samples
+
+A regression fixture must be minimized, legally redistributable, free of private
+content, and documented with the expected safe failure. Follow [AGENTS.md](AGENTS.md)
+for clean-room implementation, asset attribution and the no-crash rules. Large media
+fixtures belong in the project's approved corpus workflow rather than ordinary PRs.
+
+Ordinary feature requests, editing problems and usage questions should use the
+normal issue forms or community help channel.