Add CODEOWNERS and dedicated SECURITY.md

.gitattributes

@@ -29,3 +29,5 @@
 
 dep5                text
 packages.lock.json  text linguist-generated
+
+CODEOWNERS  text

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# SPDX-FileCopyrightText: 2026 Frans van Dorsselaer
+#
+# SPDX-License-Identifier: MIT
+
+*   @dorssel

.github/SECURITY.md

@@ -0,0 +1,20 @@
+<!--
+SPDX-FileCopyrightText: 2020 Frans van Dorsselaer
+
+SPDX-License-Identifier: MIT
+-->
+
+# Security Policy
+
+## Supported Versions
+
+Only the latest published release of the software contains the latest security fixes.
+Security fixes are not backported to older versions.
+
+Please consult the [Security Advisories](https://github.com/dorssel/dotnet-ef-sqlite-timestamp/security/advisories) for any known
+outstanding security vulnerabilities in the latest release.
+
+## Reporting a Vulnerability
+
+Please [report vulnerabilities](https://github.com/dorssel/dotnet-ef-sqlite-timestamp/security/advisories/new) privately,
+and *not* through public channels.