deps: update mkdocs-section-index requirement from <1,>=0.3 to >=0.3.12,<1

.editorconfig

@@ -1 +1,19 @@
-# TODO: phase 2
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+indent_style = space
+indent_size = 2
+
+[*.{yml,yaml}]
+indent_style = space
+indent_size = 2
+
+[*.py]
+indent_style = space
+indent_size = 4

.github/CODEOWNERS

@@ -0,0 +1,12 @@
+# Code owners for review assignment.
+# Documentation: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+* @maverick-hackz
+
+# Security-sensitive areas. Same owner today; listed explicitly so that
+# future co-maintainers do not silently inherit ownership.
+/devsecops/semgrep-rules/   @maverick-hackz
+/devsecops/ci-templates/    @maverick-hackz
+/devsecops/k8s-policies/    @maverick-hackz
+/SECURITY.md                @maverick-hackz
+/.github/                   @maverick-hackz

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,65 @@
+name: Defect or inaccuracy
+description: Report incorrect, outdated, or unsafe guidance in the handbook.
+title: "[bug]: <short description>"
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this template to report a defect in the handbook content,
+        Semgrep rules, CI/CD templates, or Kubernetes policies. For
+        security vulnerabilities in the materials (insecure defaults,
+        false-negative detection logic), prefer the private channel in
+        `SECURITY.md` instead of a public issue.
+
+  - type: input
+    id: location
+    attributes:
+      label: Affected file or rule
+      description: Path, or rule identifier for Semgrep findings.
+      placeholder: "secure-coding/python/deserialization-pickle.md"
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What is wrong, and why
+      description: >-
+        Describe the inaccuracy and the consequence of acting on the current
+        text. State the assumption that breaks or the misconception it
+        creates.
+    validations:
+      required: true
+
+  - type: textarea
+    id: source
+    attributes:
+      label: Authoritative source for the correction
+      description: >-
+        OWASP, NIST, MITRE, RFC, or vendor documentation that supports the
+        proposed correction. Blogs are supporting material, not primary
+        sources.
+      placeholder: |
+        - RFC 7515 §10.7 (https://www.rfc-editor.org/rfc/rfc7515#section-10.7)
+        - NVD entry for CVE-YYYY-NNNNN
+    validations:
+      required: true
+
+  - type: textarea
+    id: suggested-text
+    attributes:
+      label: Suggested correction (optional)
+      description: >-
+        Drop-in text or a sketch of the fix. PRs are welcome instead of
+        suggestions; both forms are accepted.
+
+  - type: checkboxes
+    id: confirmations
+    attributes:
+      label: Pre-flight checks
+      options:
+        - label: I checked for an existing open or recently closed issue covering this defect.
+          required: true
+        - label: My report does not include internal or proprietary information.
+          required: true

.github/ISSUE_TEMPLATE/content-request.yml

@@ -0,0 +1,74 @@
+name: Content request
+description: Propose a new section, writeup, secure-coding entry, or framework mapping.
+title: "[content]: <short description>"
+labels: ["content", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this template to propose new material. Out of scope: offensive
+        payloads and pentest cheatsheets (see CONTRIBUTING.md). Those
+        belong in https://github.com/maverick-hackz/Workstation.
+
+  - type: dropdown
+    id: section
+    attributes:
+      label: Target section
+      options:
+        - secure-coding/
+        - threat-modeling/
+        - secure-sdlc/
+        - devsecops/
+        - frameworks/
+        - architecture/
+        - tooling-evaluation/
+        - writeups/
+        - references/
+        - new top-level section
+    validations:
+      required: true
+
+  - type: textarea
+    id: scope
+    attributes:
+      label: Proposed scope
+      description: >-
+        What does the new material cover, and what does it intentionally
+        exclude? Two or three sentences.
+    validations:
+      required: true
+
+  - type: textarea
+    id: rationale
+    attributes:
+      label: Why this fits the handbook
+      description: >-
+        How does the proposal map to the audiences listed in the README
+        (AppSec engineers, developers, security architects, hiring
+        managers evaluating depth)?
+    validations:
+      required: true
+
+  - type: textarea
+    id: sources
+    attributes:
+      label: Primary sources you will cite
+      description: OWASP, NIST, MITRE, RFC, or vendor documentation.
+      placeholder: |
+        - OWASP API Security Top 10 2023, API1:2023
+        - NIST SP 800-204C
+        - RFC 9449
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: confirmations
+    attributes:
+      label: Pre-flight checks
+      options:
+        - label: The proposal does not duplicate existing material in this repository.
+          required: true
+        - label: The proposal does not introduce offensive payloads or pentest cheatsheets.
+          required: true
+        - label: The proposal will follow the template in the target section's README.
+          required: true

.github/ISSUE_TEMPLATE/link-rot.yml

@@ -0,0 +1,19 @@
+name: Link rot (automated)
+description: Auto-generated by the weekly link-check workflow. Do not file manually.
+title: "link-rot: scheduled lychee report"
+labels: ["link-rot", "maintenance"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This template is used by `.github/workflows/link-check.yml` when the
+        scheduled run detects broken external links. The body is replaced
+        with the lychee report at creation time. Manual reports of broken
+        references should use the `Defect or inaccuracy` template instead.
+
+  - type: textarea
+    id: report
+    attributes:
+      label: lychee report
+      value: |
+        <!-- populated by the workflow -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+<!--
+  Per CONTRIBUTING.md, a pull request description should answer four
+  questions. Replace each prompt below with a concise answer.
+-->
+
+## 1. What changed?
+
+<!-- One or two sentences. -->
+
+## 2. Which sections of the handbook were touched and why?
+
+<!-- List the affected paths (secure-coding/, devsecops/, frameworks/, ...)
+     and the motivation for each. -->
+
+## 3. Primary sources
+
+<!-- OWASP, NIST, MITRE, RFC, vendor documentation. Blogs are supporting
+     material, not primary sources. -->
+
+## 4. Validation
+
+- [ ] `markdownlint-cli2 "**/*.md"` (or affected files only)
+- [ ] `yamllint .` (if any `.yml` / `.yaml` under `devsecops/` was touched)
+- [ ] `semgrep --config devsecops/semgrep-rules/ --validate` (if rules touched)
+- [ ] `semgrep --config devsecops/semgrep-rules/ --test` (if rules touched)
+- [ ] `kubectl --dry-run=client apply -f <file>` or `kubeconform` (if K8s
+      manifests touched)
+- [ ] `lychee --offline <files>` (internal relative links resolve)
+
+## Notes for the reviewer
+
+<!-- Anything that affects how this should be evaluated: known limitations,
+     follow-ups planned in a separate PR, related issues. -->

.github/dependabot.yml

@@ -0,0 +1,40 @@
+# Dependabot configuration. See the GitHub docs for the full schema:
+# docs.github.com -> Code security -> Dependabot -> Configuration options.
+#
+# Scope: GitHub Actions in .github/workflows/ (the handbook's own CI) and
+# Python dependencies in requirements-docs.txt (mkdocs-material + plugins).
+#
+# Out of scope: the educational CI templates under devsecops/ci-templates/.
+# Dependabot's github-actions ecosystem only inspects .github/workflows/, so
+# the templates are not touched automatically. They are versioned by hand
+# alongside the handbook prose that references them.
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Moscow
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: deps
+    labels:
+      - dependencies
+      - github-actions
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Moscow
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: deps
+    labels:
+      - dependencies
+      - python