Add public contributing and security docs

Author: ogrun

CONTRIBUTING.md

@@ -0,0 +1,24 @@
+# Contributing
+
+Thanks for helping improve `ofmx2pgsql`. This repository is maintained by SkyAlgorithm and aims to stay small, auditable, and reliable.
+
+## Quick Start
+- Install locally: `pip install -e .`
+- Fetch sample data: `scripts/fetch_ofmx.sh`
+- Run tests: `python -m unittest discover -s tests`
+- Run a dry import: `python -m ofmx2pgsql import --config config/ofmx2pgsql.example.ini --dry-run --verbose`
+
+## Code Style
+- Use 4-space indentation and keep line lengths reasonable.
+- Prefer explicit names and small functions over compact logic.
+- Keep type hints where they improve clarity.
+- Avoid adding large data files to the repo (use `scripts/fetch_ofmx.sh`).
+
+## Pull Requests
+Please include:
+- A short summary of what changed and why.
+- Any new commands or flags (with examples).
+- Tests or validation steps run locally.
+
+## Scope
+Focus changes on OFMX parsing, schema evolution, and import reliability. If you are proposing major new features, open an issue first.

README.md

@@ -1,9 +1,18 @@
 # ofmx2pgsql
 
+[![CI](https://github.com/SkyAlgorithm/ofmx2pgsql/actions/workflows/ci.yml/badge.svg)](https://github.com/SkyAlgorithm/ofmx2pgsql/actions/workflows/ci.yml)
+
+An open-source SkyAlgorithm project.
+
 Lightweight importer for OpenFlightMaps OFMX data into PostgreSQL/PostGIS. The goal is a small, auditable pipeline that parses OFMX XML, normalizes geometries, and loads core aviation features into a spatial schema.
 
 ## Status
-Importer and schema are functional for the LK sample dataset. See `TODO.md` for remaining work and `PROGRESS.md` for a running log of changes.
+Importer and schema are functional for the LK sample dataset. Data is fetched on demand and CI validates parser behavior and the Docker import path.
+
+## Design Principles
+- Keep the pipeline small and auditable.
+- Favor explicit schemas over implicit inference.
+- Make data fetching and imports reproducible.
 
 ## Setup
 - `pip install -e .` installs the package and the `psycopg` dependency.
@@ -16,6 +25,7 @@ Importer and schema are functional for the LK sample dataset. See `TODO.md` for
 - `sql/migrations/` PostGIS schema migrations.
 - `config/` example configuration files.
 - `tests/` minimal unit tests for parser and CLI.
+- `scripts/` helper scripts for fetching data and container workflows.
 
 ## Current Capabilities
 - Streaming XML parsing for OFMX datasets (Ahp, Rwy, Rdn, Ase, Dpn, Ndb/Vor/Dme).
@@ -55,6 +65,12 @@ The LK sample data is fetched on demand into `data/ofmx_lk/` via `scripts/fetch_
 
 Airspace records in the LK sample reuse `AseUid/@mid`, so `ofmx.airspaces.ofmx_id` is not unique. The schema uses a composite uniqueness constraint on `(ofmx_id, region, code_id, code_type, name)` to preserve distinct entries while keeping imports idempotent.
 
+## Contributing
+See `CONTRIBUTING.md` for workflow, style, and pull request expectations.
+
+## Security
+See `SECURITY.md` for reporting guidance.
+
 ## Roadmap
 - Expand parser coverage for additional OFMX features (procedures, routes, obstacles).
 - Add integration tests that validate full imports against a disposable PostGIS instance.

SECURITY.md

@@ -0,0 +1,12 @@
+# Security Policy
+
+## Supported Versions
+We support the latest `main` branch. If you find an issue in an older commit, please still report it.
+
+## Reporting a Vulnerability
+Please report security issues via GitHub Security Advisories:
+https://github.com/SkyAlgorithm/ofmx2pgsql/security/advisories/new
+
+If you need to share sensitive details, include a minimal reproduction and the environment where the issue was observed.
+
+We aim to acknowledge reports within 5 business days.