docs: Add issue templates and security policy

Adds GitHub issue templates for bug reports and feature requests, disables blank issues, and directs users to the private security advisory flow for vulnerabilities. Also adds SECURITY.md describing the supported-version policy, how to report issues responsibly, and the security-sensitive areas covered by this reference implementation.

Author: Wizofgoz

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,64 @@
+name: Bug Report
+description: Report something that doesn't work as expected in this reference implementation.
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a report. If this is a **security vulnerability**
+        (e.g. a flaw in the RFC 9421 signature verification), please do not open a public issue —
+        see [SECURITY.md](../../SECURITY.md) instead.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: A clear description of the bug and what you expected instead.
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Include request payloads, headers, or commands where relevant.
+      placeholder: |
+        1. Send a webhook with headers ...
+        2. Run `docker compose up --build`
+        3. See error ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs or output
+      render: shell
+    validations:
+      required: false
+
+  - type: input
+    id: version
+    attributes:
+      label: Version / commit
+      description: The tag, release, or commit SHA you're running.
+    validations:
+      required: false
+
+  - type: dropdown
+    id: environment
+    attributes:
+      label: How are you running the app?
+      options:
+        - Docker Compose (as documented in the README)
+        - Other (describe below)
+    validations:
+      required: false
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Anything else that might help, e.g. .env settings (redact secrets).
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/DaySmart/dash-webhook-receiver-example-php/security/advisories/new
+    about: Please report security vulnerabilities privately rather than opening a public issue — see SECURITY.md.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,34 @@
+name: Feature Request
+description: Suggest an improvement or new scenario for this reference implementation to demonstrate.
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What's missing or could be improved?
+      description: What gap in the reference implementation prompted this request?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What would you like to see added or changed?
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Any other approaches you thought about.
+    validations:
+      required: false
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+    validations:
+      required: false

SECURITY.md

@@ -0,0 +1,48 @@
+# Security Policy
+
+This repository is a **reference implementation** demonstrating how to receive and verify Dash
+webhooks (RFC 9421 HTTP Message Signatures, replay-window enforcement, etc.). It is not a
+production service, but the signature-verification code is security-sensitive and mistakes here
+could mislead anyone adapting it for production. We take reports about it seriously.
+
+## Supported Versions
+
+This project does not maintain multiple release branches. Security fixes are applied to the
+latest version on the `main` branch only.
+
+## Reporting a Vulnerability
+
+Please **do not open a public GitHub issue** for security vulnerabilities.
+
+Instead, report it privately using GitHub's built-in reporting flow:
+
+1. Go to the [Security tab](https://github.com/DaySmart/dash-webhook-receiver-example-php/security) of this repository.
+2. Click **"Report a vulnerability"** to open a private advisory.
+
+Please include as much of the following as you can:
+
+- A description of the vulnerability and its potential impact
+- Steps to reproduce, or a proof-of-concept
+- The affected file(s)/line(s), if known
+- Any suggested remediation
+
+We'll acknowledge new reports as soon as we're able, and keep you updated as we investigate and
+address the issue. Once a fix is available, we'll coordinate on disclosure timing with you before
+publishing details.
+
+## Scope
+
+Examples of in-scope issues:
+
+- Flaws in the RFC 9421 signature verification logic (e.g. signature bypass, incorrect
+  Content-Digest validation, JWK→PEM conversion bugs)
+- Replay-window or deduplication logic that could allow forged/replayed webhook deliveries to be
+  accepted
+- Other vulnerabilities in application code under `app/`
+
+Out of scope:
+
+- Vulnerabilities in third-party dependencies (please report these upstream, e.g. via
+  [Packagist](https://packagist.org/) advisories or the dependency's own repository)
+- Issues that only affect local development ergonomics (e.g. Docker/Xdebug configuration) with no
+  security impact