docs: add LICENSE and SECURITY.md (#6)

* docs: add LICENSE and SECURITY.md

GitHub reported the licence as NOASSERTION/Other because its detector cannot
parse LICENSE.md once the vendored Lua and LuaFileSystem notices are appended.
Adding a plain LICENSE with only the canonical ISC text makes it detectable;
LICENSE.md keeps the third-party notices and now points at it. package.json
already declared ISC, so npm was never affected.

SECURITY.md records what is and is not a vulnerability here, which matters more
than usual for this package: embedding Lua hands scripts os.execute, io.open and
LuaFileSystem, so running untrusted Lua is out of scope by construction rather
than by oversight. Misuse of the low-level stack API is likewise documented
rather than treated as a defect.

Adds LICENSE to the files allowlist and to the release tarball guard. Verified
the guard still passes: 67 files, SECURITY.md correctly not shipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs: credit Maurice Schmicking by name instead of the 0x7878 handle

0x7878 is the same person; using the legal name makes the copyright line
meaningful to anyone reading it. Medaeus245 stays: that is a separate author
whose 2017 copyright cannot be removed.

Also splits the two holders onto their own lines, which is the conventional
form for multiple copyright holders, and updates package.json to name Maurice
as author with Medaeus245 as a contributor.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: mschmicking

.github/workflows/release.yml

@@ -80,7 +80,7 @@ jobs:
             }
             const files = entry.files.map(f => f.path);
 
-            const needed = ['index.js', 'binding.gyp', 'src/luastate.cc', 'src/nodelua.cc', 'src/utils.cc', 'vendor/lfs/lfs.c', 'README.md', 'LICENSE.md'];
+            const needed = ['index.js', 'binding.gyp', 'src/luastate.cc', 'src/nodelua.cc', 'src/utils.cc', 'vendor/lfs/lfs.c', 'README.md', 'LICENSE', 'LICENSE.md'];
             const missing = needed.filter(n => !files.includes(n));
             if (missing.length) {
               console.error('missing from tarball:', missing.join(', '));

LICENSE

@@ -0,0 +1,16 @@
+ISC License
+
+Copyright (c) 2017, Medaeus245
+Copyright (c) 2023, Maurice Schmicking
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

LICENSE.md

@@ -1,7 +1,14 @@
 
 ## License & Copyrights
 
-#### The ISC Licence (ISC) Copyright (c) 2017, Medaeus245, 0x7878
+This project is ISC licensed. The canonical licence text lives in [LICENSE](LICENSE);
+this file repeats it and adds the notices for the third-party sources compiled into
+the addon.
+
+#### The ISC Licence (ISC)
+
+Copyright (c) 2017, Medaeus245
+Copyright (c) 2023, Maurice Schmicking (previously credited as 0x7878)
 
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above

SECURITY.md

@@ -0,0 +1,52 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+| ------- | --------- |
+| 2.x     | Yes       |
+| 1.x     | No        |
+
+1.x does not build on current Node.js and carries several memory-safety defects that
+2.0.0 fixed, including a fixed-size buffer that arbitrary-length Lua error messages
+were formatted into. Please upgrade rather than asking for a backport.
+
+## Reporting a vulnerability
+
+Please report privately through GitHub's
+[security advisory form](https://github.com/mschmicking/node-lua-runner/security/advisories/new)
+rather than opening a public issue.
+
+Include what you need to reproduce it: the Lua and JavaScript involved, your platform
+and Node.js version, and what you observed.
+
+If that form is not available to you, open an issue asking for a private channel —
+without the details — rather than posting them publicly.
+
+You should get an acknowledgement within a week or so. This is a spare-time project,
+so please treat that as a good-faith aim and not a guarantee.
+
+## Scope
+
+This package embeds a Lua interpreter in your Node.js process, which shapes what
+counts as a vulnerability here.
+
+**In scope** — anything in `src/` that lets *ordinary* use go wrong: memory
+corruption, use-after-free, or a process crash reachable from normal API calls or
+from Lua code with no unusual privileges.
+
+**Not in scope:**
+
+- **Running untrusted Lua.** This library gives Lua scripts the full standard
+  library, including `os.execute`, `io.open` and `require`, plus LuaFileSystem. A Lua
+  script can therefore run commands and read and write files with the privileges of
+  your Node.js process. That is what embedding Lua means; it is not a defect in this
+  package. Do not feed it code you would not run yourself.
+- **Misusing the low-level stack API.** This is a thin wrapper over the Lua C API and
+  does not shield you from every misuse of it. Some operations on values of an
+  unexpected type raise an *unprotected* Lua error, which aborts the process rather
+  than throwing. `SetField` and `GetField` guard against this; other methods do not.
+  A crash reached that way is documented behaviour, not a vulnerability.
+- **Findings in `vendor/`.** Lua 5.1.5 and LuaFileSystem are vendored verbatim and are
+  not patched here. Report those upstream. If something in them is genuinely
+  exploitable through this package's API, do report it here as well.

package.json

@@ -2,7 +2,10 @@
   "name": "node-lua-runner",
   "version": "2.0.0",
   "description": "Embed Lua 5.1 in Node.js. Lua and LuaFileSystem are compiled into the addon, so there is nothing to install on the system.",
-  "author": "medaeus245, 0x7878",
+  "author": "Maurice Schmicking",
+  "contributors": [
+    "Medaeus245"
+  ],
   "main": "index.js",
   "keywords": [
     "lua",
@@ -24,6 +27,7 @@
     "src/",
     "vendor/",
     "README.md",
+    "LICENSE",
     "LICENSE.md"
   ],
   "scripts": {