Add SECURITY.md, CONTRIBUTING.md, and CODEOWNERS

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# delego sample app — the maintainer reviews all contributions.
+# Enforced via branch protection (require review from Code Owners).
+* @koishore

CONTRIBUTING.md

@@ -0,0 +1,43 @@
+# Contributing to the delego sample app
+
+This is a deliberately small (~150-line) **reference app** showing how to build on
+[delego](https://github.com/Delego-Dev/delego). Its value is being clear and honest
+about the integration, so contributions should keep it minimal and readable rather
+than feature-rich.
+
+## Development setup
+
+Requires Python 3.10+.
+
+```bash
+git clone https://github.com/Delego-Dev/sample-app
+cd sample-app
+python -m venv .venv && . .venv/bin/activate
+pip install -r requirements.txt
+```
+
+## Run and test
+
+```bash
+uvicorn app.main:app --reload      # http://127.0.0.1:8000/docs
+pytest                             # the API regression tests
+```
+
+CI runs `pytest` on Python 3.10, 3.11, and 3.12 (`.github/workflows/ci.yml`); keep
+it green. Run a **single** uvicorn worker — delego's state is file-backed.
+
+## Pull requests
+
+- **Fork** and open the PR from a branch in your fork; direct pushes to `main` are
+  not accepted (it is branch-protected and requires review).
+- Keep changes small and explain the *why*. The only app-specific code is the
+  [`BrokerAdapter`](app/broker.py) and the [policy](policy.yaml) — most behaviour
+  lives in the published `delego` package, so fixes to the firewall itself belong
+  [upstream](https://github.com/Delego-Dev/delego).
+- Run `pytest` before submitting; add or adjust tests for any behaviour change.
+
+## A note on AI assistance
+
+AI-assisted contributions are welcome — but you are accountable for what you
+submit. Review and test generated code, and disclose significant AI assistance in
+the PR description.

SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+
+This is a **reference sample app** — a ~150-line FastAPI service that demonstrates
+how to build on [delego](https://github.com/Delego-Dev/delego). It is meant to be
+read and adapted, **not deployed as-is in production**.
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for security vulnerabilities.**
+
+Report privately via GitHub's
+[private vulnerability reporting](https://github.com/Delego-Dev/sample-app/security/advisories/new),
+or email **koishore@gmail.com**. We aim to acknowledge within 72 hours.
+
+## Scope
+
+- **In scope:** a flaw in how this sample *uses* delego that teaches an unsafe
+  pattern — e.g. the example [`BrokerAdapter`](app/broker.py) executing an action
+  other than the one that was authorized, or the API releasing an approval that
+  doesn't match the proposed action.
+- **Out of scope:** the demo's lack of production hardening (no auth on the
+  endpoints, single-worker file-backed state) — these are documented
+  simplifications, not bugs. A real deployment must add its own authentication,
+  transport security, and a credentialed broker.
+- **delego itself:** report against
+  [delego](https://github.com/Delego-Dev/delego/security), not here.
+
+## Supported versions
+
+Only the latest commit on `main` is maintained; the app tracks the newest
+released `delego`.