Remove SECURITY.md

It asked for reports through GitHub's Security tab, which Gogs
doesn't have.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -231,8 +231,6 @@ curl -L -A "Mozilla/5.0" -o page.html "https://example.com/the-article"
 - **What sites see.** Requests look like a desktop browser and include "ReKoPub" in the user agent. Image requests send the article's address as the referrer, as browsers do. ReKoPub sends no cookies, never logs in and runs no JavaScript.
 - **Your files are safe.** Existing files are only replaced with `-FORCE`. Filenames made from article titles contain only letters, digits and dashes, so a title can't place the book outside the folder you chose.
 
-To report a security problem, see [`SECURITY.md`](SECURITY.md).
-
 ---
 
 ## Limitations

SECURITY.md

@@ -1,22 +0,0 @@
-# Security policy
-
-## Supported versions
-
-Security fixes go into the latest release only. Please update to it before reporting a problem.
-
-## Reporting a vulnerability
-
-Please report security problems privately, not in a public issue: on GitHub, open the repository's **Security** tab and choose **Report a vulnerability**. Include the output of `rekopub -VERSION`, the command you ran, and what happened.
-
-You should get a reply within a week. Once a fix is released, the report is published as a security advisory, with credit to you unless you prefer otherwise.
-
-## Scope
-
-ReKoPub downloads web pages chosen by its user, which are untrusted input. Problems in scope include:
-
-- a page making ReKoPub read or write files other than the book it was asked to save;
-- a page making ReKoPub connect to the user's own computer or network when `-URL` is on the internet;
-- a page producing a book that runs scripts or loads remote content in a reader;
-- crashes or runaway memory use caused by a page or image.
-
-What ReKoPub does to stay safe is described under [Privacy and security](README.md#privacy-and-security) in the README.

pull-releases/001-rekopub-import/README.md

@@ -4,19 +4,18 @@ Branch `feature/rekopub-import` · no version change (the code is the same as th
 
 ## What changed
 
-- **Whole project imported** from the previous repository's latest `main`: the CLI, `internal/` packages, tests and test data, `PLAN.md`, `SECURITY.md`, `build.cmd`, `test-examples.cmd` and the GoReleaser config. It's a single commit with no earlier history, so the old name only survives in the old repository.
+- **Whole project imported** from the previous repository's latest `main`: the CLI, `internal/` packages, tests and test data, `PLAN.md`, `build.cmd`, `test-examples.cmd` and the GoReleaser config. It's a single commit with no earlier history, so the old name only survives in the old repository.
 - **Renamed to ReKoPub.** The project is called ReKoPub in prose and `rekopub` in code: the binary, `cmd/rekopub/`, the usage text, `-VERSION` output, the user agent (`compatible; rekopub`), error messages, the internal stand-in host for image URLs (`rekopub.invalid`), the build scripts, GoReleaser archive names and `.gitignore`.
 - **New module path** `git.monoexp.com/bajdev/rekopub` (Gogs answers `?go-get=1` for it), so `go install git.monoexp.com/bajdev/rekopub/cmd/rekopub@latest` works. Clone and Releases links in the README point to `git.monoexp.com/bajdev/ReKoPub`.
 - **`LICENSE`**: the Gogs template's `<year> <copyright holders>` placeholder is replaced by the project's MIT licence, `Copyright (c) 2026 bajdev`.
 - **`README.md`**: the project README replaces the Gogs placeholder, keeping its "Turn any web article into a clean EPUB for your e-ink reader" tagline.
-- **GitHub-only files removed:** the CI and Release workflows (`.github/workflows/`), which don't run on Gogs.
+- **GitHub-only files removed:** the CI and Release workflows (`.github/workflows/`), which don't run on Gogs, and `SECURITY.md`, which asked for reports through GitHub's Security tab. The README's link to it is gone.
 - **Releases are built locally:** `.goreleaser.yaml` takes its changelog from git instead of GitHub and no longer publishes a release; it writes the archives and checksums to `dist/`. The README's "Releasing" section now says to run govulncheck, tag, run `goreleaser release --clean` and attach the files from `dist/` to a Gogs release. The lines saying CI runs epubcheck are gone.
 - **`pull-releases/`**: this record and the index, started with this PR.
 
 ## Notes
 
 - Without CI, nothing runs the checks automatically: gofmt, vet, staticcheck, govulncheck, epubcheck and the Windows and macOS test runs are now done by hand.
-- `SECURITY.md` still asks for reports through GitHub's Security tab, which Gogs doesn't have. It needs a contact before the next release.
 - `PLAN.md` is left as written: its CI and GitHub release lines describe how the project was originally planned.
 
 ## Testing