MIT license (permissive, attribution required); SECURITY.md documents the personal-use threat model and private reporting channels (email + GitHub Security Advisories).
