Add CONTRIBUTING.md, SECURITY.md and a bug report issue template.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,47 @@
+name: Bug report
+description: sqlx does something wrong
+labels: [bug]
+body:
+- type: input
+  id: versions
+  attributes:
+    label: Versions
+    description: sqlx, Go, the driver and the database, each with its version
+    placeholder: sqlx v1.4.1, go1.27.2, lib/pq v1.10.9, PostgreSQL 16
+  validations:
+    required: true
+- type: textarea
+  id: query
+  attributes:
+    label: The query
+    description: The SQL you pass to sqlx and the call you make (Get, Select, NamedExec, In, ...)
+    render: sql
+  validations:
+    required: true
+- type: textarea
+  id: destination
+  attributes:
+    label: The struct, map or slice
+    description: The Go type you bind or scan into, with its `db` tags
+    render: go
+  validations:
+    required: true
+- type: textarea
+  id: actual
+  attributes:
+    label: What happens
+    description: The error text, the panic trace or the wrong result
+  validations:
+    required: true
+- type: textarea
+  id: expected
+  attributes:
+    label: What you expected
+  validations:
+    required: true
+- type: textarea
+  id: reproduction
+  attributes:
+    label: Minimal reproduction
+    description: A failing test in the style of sqlx_test.go is ideal
+    render: go

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+- name: Question
+  url: https://github.com/secondwindoss/sqlx/discussions
+  about: How do I ... questions go to Discussions, not the issue tracker.

CONTRIBUTING.md

@@ -0,0 +1,48 @@
+# Contributing
+
+Bug reports, fixes, tests and documentation are all welcome.
+
+## Reporting a bug
+
+Open an issue with the bug report template. The driver and database
+version, the SQL, the struct or map you bind or scan, and what you expected
+are what make a report reproducible. A failing test in the style of
+`sqlx_test.go` is the best report of all. Questions about how to use sqlx go
+to [Discussions](https://github.com/secondwindoss/sqlx/discussions).
+
+## Making a change
+
+1. Branch from `master`.
+2. Add or update a test. The suite always runs against SQLite and also runs
+   against Postgres and MySQL when their DSN variables are set:
+
+       docker run -d --name sqlx-pg -e POSTGRES_PASSWORD=sqlx -p 5432:5432 postgres:16
+       docker run -d --name sqlx-mysql -e MYSQL_ROOT_PASSWORD=sqlx -e MYSQL_DATABASE=sqlx -p 3306:3306 mysql:8
+       export SQLX_POSTGRES_DSN='postgres://postgres:sqlx@localhost:5432/postgres?sslmode=disable'
+       export SQLX_MYSQL_DSN='root:sqlx@tcp(127.0.0.1:3306)/sqlx'
+       export SQLX_SQLITE_DSN=/tmp/sqlx.db
+       make test-race
+
+   The test binary prints `Disabling Postgres tests` or `Disabling MySQL
+   tests` when it cannot connect; CI fails on either line, so make sure both
+   databases are reachable before you rely on a local run.
+3. Run `make tooling` once, then `make lint fmt vuln-check` before pushing.
+4. Open a pull request against `master`. CI runs the lint job and the race
+   tests on Go 1.23 to stable with all three databases and must be green
+   before the merge.
+
+Keep the exported API unchanged within v1 unless the change is purely
+additive. The `db` tag rules, the default `NameMapper`, the bind constants and
+the output of `Named`, `Rebind` and `In` for existing queries are a
+compatibility contract.
+
+## Importing an upstream pull request
+
+Pull requests that were opened against upstream `jmoiron/sqlx` are welcome
+here. Fetch the pull request head and merge it, so the original commits keep
+their authors, then add a line to `CHANGELOG.md` naming the upstream pull
+request number and author.
+
+## Commit messages
+
+One sentence that says what the change does.

SECURITY.md

@@ -0,0 +1,17 @@
+# Security policy
+
+## Supported versions
+
+The latest fork release receives security fixes. Versions up to v1.4.0 are
+upstream `jmoiron/sqlx` releases and are not patched here.
+
+## Reporting a vulnerability
+
+Report it privately through GitHub at
+<https://github.com/secondwindoss/sqlx/security/advisories/new>. Please do not
+open a public issue. You will hear back from a maintainer, and the fix and the
+advisory are published together once a release is out.
+
+sqlx passes the query strings you give it to the driver as they are; it does
+not validate or escape SQL. A query built from untrusted input is an injection
+in the calling code, not in sqlx, and is out of scope.