From b9078cf9232a35d3bdcc0bfc01ab5d851abfc328 Mon Sep 17 00:00:00 2001
From: Sage Hart - AI <sagehart-ai@Sages-MacBook-Pro.local>
Date: Sun, 11 Oct 2026 19:10:27 -0500
Subject: [PATCH] Add a documentation map and keep one security policy.

---
 .github/SECURITY.md | 32 --------------------------------
 README.md           |  5 +++++
 docs/README.md      | 29 +++++++++++++++++++++++++++++
 3 files changed, 34 insertions(+), 32 deletions(-)
 delete mode 100644 .github/SECURITY.md
 create mode 100644 docs/README.md

diff --git a/.github/SECURITY.md b/.github/SECURITY.md
deleted file mode 100644
index c1e3128..0000000
--- a/.github/SECURITY.md
+++ /dev/null
@@ -1,32 +0,0 @@
-# Security Policy
-
-## Supported versions
-
-| Version | Supported |
-|---------|-----------|
-| `main` (latest) | Yes |
-| Tagged releases | Security fixes backported at maintainer discretion |
-
-Security fixes are applied to the default branch (`main`).
-
-## Reporting a Vulnerability
-
-**Please do not open public GitHub issues for security vulnerabilities.**
-
-Report security issues privately by opening a [GitHub Security Advisory](https://github.com/SafetyMP/Professional-Service-Automation/security/advisories/new) or contacting the repository maintainers directly.
-
-Include:
-
-- Description of the issue and potential impact
-- Steps to reproduce
-- Affected versions or commits
-- Suggested fix (if any)
-
-We aim to acknowledge reports within a few business days and will coordinate disclosure before any public fix.
-
-## Secure deployment
-
-- Change all demo passwords before production use
-- Set a strong, unique `AUTH_SECRET`
-- Use TLS in production and restrict database network access
-- Review PostgreSQL RLS policies in `prisma/rls.sql` for your deployment model
diff --git a/README.md b/README.md
index cabb3a8..b29c718 100644
--- a/README.md
+++ b/README.md
@@ -179,3 +179,8 @@ See [`SECURITY.md`](SECURITY.md) for reporting vulnerabilities.
 ## License
 
 [Apache License 2.0](LICENSE)
+
+
+## Documentation map
+
+[docs/README.md](docs/README.md) lists the repository layout. Community policy files are the root `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, and `SECURITY.md`.
diff --git a/docs/README.md b/docs/README.md
new file mode 100644
index 0000000..8d11307
--- /dev/null
+++ b/docs/README.md
@@ -0,0 +1,29 @@
+# Documentation map
+
+Start at the root [README](../README.md).
+
+- [DESIGN-PIVOT.md](./DESIGN-PIVOT.md) — what this repository is for
+- [development.md](./development.md)
+- [deploy.md](./deploy.md)
+- [phase-2-complete.md](./phase-2-complete.md) — what the billing slice contains
+- [adr/](./adr/)
+
+## Repository layout
+
+| Path | What it is |
+| --- | --- |
+| `src/` | Next.js app |
+| `lib/` | Domain services (billing, dashboard, reporting) |
+| `prisma/` | Schema and migrations |
+| `tests/` | Unit tests |
+| `e2e/` | Playwright |
+| `specs/` | Product scope notes |
+| `docker/` | Compose helpers |
+| `_archives/` | Not the application path |
+
+Community files: root [CONTRIBUTING.md](../CONTRIBUTING.md), [CODE_OF_CONDUCT.md](../CODE_OF_CONDUCT.md), [SECURITY.md](../SECURITY.md).
+
+
+## Canonical community files
+
+`CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, and `SECURITY.md` are at the repository root. This repository does not keep a second copy under `.github/`, because GitHub would show that copy instead of the root file.