docs: add LICENSE and SECURITY.md

GitHub reported the licence as NOASSERTION/Other because its detector cannot
parse LICENSE.md once the vendored Lua and LuaFileSystem notices are appended.
Adding a plain LICENSE with only the canonical ISC text makes it detectable;
LICENSE.md keeps the third-party notices and now points at it. package.json
already declared ISC, so npm was never affected.

SECURITY.md records what is and is not a vulnerability here, which matters more
than usual for this package: embedding Lua hands scripts os.execute, io.open and
LuaFileSystem, so running untrusted Lua is out of scope by construction rather
than by oversight. Misuse of the low-level stack API is likewise documented
rather than treated as a defect.

Adds LICENSE to the files allowlist and to the release tarball guard. Verified
the guard still passes: 67 files, SECURITY.md correctly not shipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mschmicking

.github/workflows/release.yml

@@ -80,7 +80,7 @@ jobs:
             }
             const files = entry.files.map(f => f.path);
 
-            const needed = ['index.js', 'binding.gyp', 'src/luastate.cc', 'src/nodelua.cc', 'src/utils.cc', 'vendor/lfs/lfs.c', 'README.md', 'LICENSE.md'];
+            const needed = ['index.js', 'binding.gyp', 'src/luastate.cc', 'src/nodelua.cc', 'src/utils.cc', 'vendor/lfs/lfs.c', 'README.md', 'LICENSE', 'LICENSE.md'];
             const missing = needed.filter(n => !files.includes(n));
             if (missing.length) {
               console.error('missing from tarball:', missing.join(', '));

LICENSE

@@ -0,0 +1,15 @@
+ISC License
+
+Copyright (c) 2017, Medaeus245, 0x7878
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

LICENSE.md

@@ -1,6 +1,10 @@
 
 ## License & Copyrights
 
+This project is ISC licensed. The canonical licence text lives in [LICENSE](LICENSE);
+this file repeats it and adds the notices for the third-party sources compiled into
+the addon.
+
 #### The ISC Licence (ISC) Copyright (c) 2017, Medaeus245, 0x7878
 
 Permission to use, copy, modify, and/or distribute this software for any

SECURITY.md

@@ -0,0 +1,52 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+| ------- | --------- |
+| 2.x     | Yes       |
+| 1.x     | No        |
+
+1.x does not build on current Node.js and carries several memory-safety defects that
+2.0.0 fixed, including a fixed-size buffer that arbitrary-length Lua error messages
+were formatted into. Please upgrade rather than asking for a backport.
+
+## Reporting a vulnerability
+
+Please report privately through GitHub's
+[security advisory form](https://github.com/mschmicking/node-lua-runner/security/advisories/new)
+rather than opening a public issue.
+
+Include what you need to reproduce it: the Lua and JavaScript involved, your platform
+and Node.js version, and what you observed.
+
+If that form is not available to you, open an issue asking for a private channel —
+without the details — rather than posting them publicly.
+
+You should get an acknowledgement within a week or so. This is a spare-time project,
+so please treat that as a good-faith aim and not a guarantee.
+
+## Scope
+
+This package embeds a Lua interpreter in your Node.js process, which shapes what
+counts as a vulnerability here.
+
+**In scope** — anything in `src/` that lets *ordinary* use go wrong: memory
+corruption, use-after-free, or a process crash reachable from normal API calls or
+from Lua code with no unusual privileges.
+
+**Not in scope:**
+
+- **Running untrusted Lua.** This library gives Lua scripts the full standard
+  library, including `os.execute`, `io.open` and `require`, plus LuaFileSystem. A Lua
+  script can therefore run commands and read and write files with the privileges of
+  your Node.js process. That is what embedding Lua means; it is not a defect in this
+  package. Do not feed it code you would not run yourself.
+- **Misusing the low-level stack API.** This is a thin wrapper over the Lua C API and
+  does not shield you from every misuse of it. Some operations on values of an
+  unexpected type raise an *unprotected* Lua error, which aborts the process rather
+  than throwing. `SetField` and `GetField` guard against this; other methods do not.
+  A crash reached that way is documented behaviour, not a vulnerability.
+- **Findings in `vendor/`.** Lua 5.1.5 and LuaFileSystem are vendored verbatim and are
+  not patched here. Report those upstream. If something in them is genuinely
+  exploitable through this package's API, do report it here as well.

package.json

@@ -24,6 +24,7 @@
     "src/",
     "vendor/",
     "README.md",
+    "LICENSE",
     "LICENSE.md"
   ],
   "scripts": {