docs(github): add LICENSE + SECURITY.md

MIT license (permissive, attribution required); SECURITY.md documents
the personal-use threat model and private reporting channels (email +
GitHub Security Advisories).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 James Maes / KofTwentyTwo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Jarvis is a personal-use macOS application; the threat model assumes a
+single trusted user. The most likely security-relevant surfaces are:
+
+- **AppleScript automation** — gated behind a per-call HUD confirmation
+  (`requiresConfirmation: true`); enforced by
+  `scripts/check-applescript-confirmation.sh`.
+- **Anthropic API key storage** — macOS Keychain only; never plaintext.
+- **Ollama loopback enforcement** — `OllamaConfig` rejects non-loopback
+  hosts at config load (AGENT-05 in CLAUDE.md).
+- **Hardened Runtime + JIT entitlement** — required for WKWebView
+  JavaScriptCore on Apple Silicon.
+
+If you find a vulnerability, report it privately:
+
+- Email: jmaes@dmdbrands.com
+- GitHub Security Advisory: <https://github.com/KofTwentyTwo/Jarvis/security/advisories/new>
+
+Please do NOT open a public issue for security reports. Allow up to 7 days
+for an acknowledgement.
+
+## Supported versions
+
+Only `develop` is supported. Tagged releases are not yet a thing for this
+project.