chore: repo professionalization — templates, security, contributing, codeowners

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Every file in this repo defaults to the maintainer for review.
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+*       @Layellie

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,51 @@
+name: Bug report
+description: Something is broken or behaves incorrectly.
+title: "[bug] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report. Please fill in what you can — incomplete reports take longer to triage.
+  - type: input
+    id: version
+    attributes:
+      label: App version
+      description: Settings panel shows the version at the bottom right (e.g. v2.1.0).
+      placeholder: "v2.1.0"
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Windows version
+      description: Run `winver` and copy the version + build.
+      placeholder: "Windows 11 24H2 (build 26100.2314)"
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: What did you do, what did you expect, what did you see instead?
+      placeholder: |
+        1. Opened Settings panel
+        2. Clicked Export
+        3. Expected a file dialog; got a silent no-op
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant log lines
+      description: "Settings → Open Log Folder → `log.txt`. Paste the last ~30 lines around the time the bug happened. Remove anything personal."
+      render: shell
+  - type: checkboxes
+    id: confirm
+    attributes:
+      label: Pre-flight
+      options:
+        - label: I am running the app as Administrator (UAC prompt was accepted).
+          required: true
+        - label: I searched existing issues and this is not a duplicate.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/Layellie/StandbyAndTimer/security/policy
+    about: Please report security issues privately — do not open a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,31 @@
+name: Feature request
+description: Suggest a new capability or enhancement.
+title: "[feature] "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: Describe the user-visible problem first, not the solution.
+      placeholder: |
+        When I'm in a fullscreen game, I want the timer status icon to flash if the resolution falls off 0.5 ms — right now I only see it after alt-tabbing back to the tray.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: How you imagine it working. Mockups, sketches, or "I don't know yet" are all fine.
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches you thought about and why you didn't pick them.
+  - type: checkboxes
+    id: confirm
+    attributes:
+      label: Pre-flight
+      options:
+        - label: I searched existing issues and this isn't already requested.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,21 @@
+## Summary
+
+<!-- 1–3 bullets on what changed and why. Skip if the title is self-explanatory. -->
+
+## Files
+
+<!-- One line per touched area, e.g.
+- `Services/TimerResolutionService.cs` — restart watchdog when MMCSS thread name changes
+-->
+
+## Test plan
+
+- [ ] `dotnet build -c Release` — 0 warnings, 0 errors
+- [ ] Smoke-tested the affected feature manually (UAC accepted, app running)
+- [ ] Touched a `Views/Cards/*.xaml`? Resized window, confirmed no layout shift
+- [ ] Touched a service that owns a `PerformanceCounter`, `Process`, or native handle? Verified `OnExit` still releases it
+- [ ] Touched a string in `Strings.en-US.xaml`? Mirrored in `Strings.tr-TR.xaml`
+
+## Release note
+
+<!-- One sentence the next GitHub release page should include, or "internal — skip changelog". -->

CONTRIBUTING.md

@@ -0,0 +1,60 @@
+# Contributing
+
+Thanks for considering a contribution. StandbyAndTimer is a one-person
+project; the bar here isn't formal, but a few conventions keep the codebase
+coherent.
+
+## Filing issues
+
+Use the [issue templates](https://github.com/Layellie/StandbyAndTimer/issues/new/choose).
+- **Bug:** include app version, Windows build (`winver`), and ~30 lines from
+  `log.txt` (Settings → Open Log Folder).
+- **Feature:** lead with the user-visible problem before proposing a
+  solution. Mockups welcome.
+- **Security:** see [`SECURITY.md`](SECURITY.md) — please don't open a public
+  issue.
+
+## Sending pull requests
+
+### Setup
+
+```powershell
+git clone https://github.com/Layellie/StandbyAndTimer.git
+cd StandbyAndTimer
+dotnet build StandbyAndTimer/StandbyAndTimer.csproj -c Release
+```
+
+You need the .NET 10 SDK. UAC will prompt when you run the app — the P/Invoke
+calls require Administrator.
+
+### Conventions
+
+- **Code style** matches what's already in the file. Don't reformat unrelated
+  code in a feature PR.
+- **All P/Invoke** must live in `Services/Native/NativeMethods.cs`. Nothing
+  else should import `System.Runtime.InteropServices` directly.
+- **MVVM** strictly: views own no logic beyond what's in `MainWindow.xaml.cs`
+  today (DataContext wiring + drag/drop event forwarding).
+- **Localization:** every user-visible string ships in both
+  `Strings.en-US.xaml` and `Strings.tr-TR.xaml`. If you add an English string
+  and don't speak Turkish, mark the TR entry `<!-- TODO translate -->` and
+  I'll fill it in on review.
+- **No new top-level files** without a reason — the root is curated
+  (`ARCHITECTURE.md`, `CLAUDE.md`, `LICENSE`, `README.md`, `SECURITY.md`,
+  `CONTRIBUTING.md`).
+- **One PR = one logical change.** Bundle small Settings-panel polish fixes
+  if they're all the same theme; don't bundle "polish + new feature."
+- **CI must pass** (`Build (Release)` with `-warnaserror`). Don't bypass.
+
+### Review
+
+I'll usually respond within a few days. For non-trivial PRs I might ask for
+a follow-up commit rather than push directly — please don't squash mid-review
+unless asked.
+
+## Architecture pointer
+
+Before changing service wiring or adding a new layer, skim
+[`ARCHITECTURE.md`](ARCHITECTURE.md). The Core / Services / Infrastructure /
+ViewModels split is enforced by convention, not the compiler — keeping it
+clean is on us.

SECURITY.md

@@ -0,0 +1,50 @@
+# Security policy
+
+StandbyAndTimer runs **with Administrator privileges** and makes direct calls
+into `ntdll` (`NtSetTimerResolution`, `NtSetSystemInformation`) and the
+Windows scheduler. A vulnerability here is more impactful than in a typical
+user-mode app, so I treat security reports seriously and prioritize them.
+
+## Supported versions
+
+Only the **latest published release** receives security fixes. The version is
+visible in the Settings panel footer of the app, and on the
+[Releases page](https://github.com/Layellie/StandbyAndTimer/releases).
+
+Older 2.0.x releases that have been marked **pre-release** on GitHub are
+superseded interim builds — they will not receive backported fixes; please
+upgrade.
+
+## How to report
+
+Please **do not open a public issue or pull request** for security problems.
+
+Use GitHub's private security advisory flow:
+
+1. Go to <https://github.com/Layellie/StandbyAndTimer/security/advisories/new>
+2. Fill in the report (a brief reproducer is enough — proof-of-concept code
+   is welcome but not required).
+
+If GitHub advisories aren't an option for you, email **sametkasmer16@gmail.com**
+with subject prefix `[SECURITY] StandbyAndTimer` and I'll respond within
+seven days to coordinate a fix.
+
+## What to include
+
+- Affected version (from the Settings panel footer).
+- Windows build (`winver`).
+- A short reproducer or scenario.
+- Your assessment of impact (local privilege escalation, denial of service,
+  information disclosure, etc.).
+
+## What to expect from me
+
+- **Acknowledgement** of receipt within 7 days.
+- **A triage decision** (accepted, needs-info, won't-fix-and-why) within
+  14 days of full reproducer.
+- **A patched release** for accepted reports as fast as I can build and
+  publish one; for non-trivial issues I'll coordinate a disclosure date
+  with you.
+- **Credit** in the release notes if you'd like — let me know how to attribute.
+
+Thank you for helping keep StandbyAndTimer's users safe.