Polish public repository docs and CI

Author: meganfoster-dotcom

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,22 @@
+---
+name: Bug report
+about: Report a reproducible problem
+title: "[Bug]: "
+labels: bug
+---
+
+## What happened?
+
+## Steps to reproduce
+1.
+2.
+3.
+
+## Expected behavior
+
+## Environment
+- OS:
+- Version/commit:
+
+## Logs or screenshots
+Remove secrets before pasting logs.

.github/pull_request_template.md

@@ -0,0 +1,8 @@
+## Summary
+
+## Validation
+- [ ] Tests/checks run
+- [ ] Documentation updated
+- [ ] No secrets committed
+
+## Screenshots / notes

CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## Unreleased
+
+- Added repository polish: security policy, contribution workflow, CI baseline, and clearer documentation structure.
+
+## Initial Public Version
+
+- Published the first public project version.

README.md

@@ -1,5 +1,19 @@
 # Setupr
 
+> AI-powered CLI that detects project stacks, plans setup, installs dependencies, configures environments, and verifies local health.
+
+![Status](https://img.shields.io/badge/status-beta-6b7280) ![License](https://img.shields.io/github/license/Evan1108-Coder/Setupr) ![CI](https://img.shields.io/github/actions/workflow/status/Evan1108-Coder/Setupr/ci.yml?branch=main&label=CI)
+
+**TypeScript CLI • stack detection • setup automation • project doctor**
+
+## At a Glance
+
+- Real project documentation now includes security, contribution, changelog, CI, and issue/PR workflows.
+- Maintenance snapshot: see [docs/project-snapshot.md](docs/project-snapshot.md) for a generated file-mix chart and repository checklist.
+- Public repo: https://github.com/Evan1108-Coder/Setupr
+
+---
+
 > Status: beta. Setupr is usable as a CLI today, but some stack-specific setup paths still need more real-world testing.
 
 Setupr is for developers who clone projects often and do not want to manually guess install commands, runtime versions, environment files, ports, or verification steps.
@@ -124,4 +138,4 @@ Project-level config via `.setupr.json`:
 
 ## License
 
-MIT
+MIT

SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are handled on the default branch unless a release branch is explicitly listed.
+
+## Reporting a Vulnerability
+
+Please do not open a public issue for a suspected vulnerability. Email the maintainer or use GitHub's private vulnerability reporting when available. Include:
+
+- Affected version or commit
+- Steps to reproduce
+- Impact and likelihood
+- Any relevant logs with secrets removed
+
+## Secret Handling
+
+Never commit API keys, Telegram tokens, OAuth credentials, database files, `.env` files, or local user exports. Use `.env.example` for placeholders only.

docs/project-snapshot.md

@@ -0,0 +1,34 @@
+# Project Snapshot
+
+Generated from the repository tree for public README/maintenance polish. Counts exclude `.git`, dependency folders, and build outputs.
+
+## File Mix
+
+- TypeScript: 114 files (71%)
+- TSX: 28 files (17%)
+- Markdown: 11 files (7%)
+- JSON: 7 files (4%)
+- JavaScript: 1 files (1%)
+
+```mermaid
+pie title Source/documentation file mix
+    "JavaScript" : 1
+    "TypeScript" : 114
+    "TSX" : 28
+    "Markdown" : 11
+    "JSON" : 7
+```
+
+## Maintenance Checklist
+
+- README describes purpose, setup, and limitations.
+- CI runs baseline install/test/build checks where applicable.
+- SECURITY.md explains vulnerability and secret handling.
+- CHANGELOG.md tracks public changes.
+- Issue and PR templates are available.
+
+## Real Test Snapshot
+
+- `npm test -- --runInBand` completed successfully on 2026-06-08.
+- Current suite footprint: 28 Vitest files / 3,555 test lines under `tests/`.
+- Coverage areas visible from filenames: auth, environment handling, dependency intelligence, git intelligence, TUI, setup flow, plugins, scanner, memory, and verification security.