docs: record verified development delivery and explicit release gates

Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.

SECURITY.md

@@ -0,0 +1,69 @@
+# Security policy
+
+**Development software: no production-readiness claim.** Only the current
+development branch is maintained; no stable mobile release exists yet.
+
+Do not post vulnerabilities, cookies, private URLs, household records or keys in a
+public issue. Contact the community repository's owner through an established
+private channel or enable the host's private vulnerability-reporting mechanism
+before public distribution. No private reporting mailbox has been supplied; we
+will not invent one. If none is available, request a private contact without
+including exploit details. Upstream Yuvomi vulnerabilities belong in
+[upstream's private reporting channel](https://github.com/ulsklyc/yuvomi/security/advisories/new),
+not its public issue tracker. This project cannot promise upstream response times.
+
+Include affected app/OS/WebView/server versions, reproduction steps, impact,
+and a minimal sanitized demonstration. Never include real credentials.
+
+## Security model
+
+- The user selects one HTTPS origin, including its port. A valid TLS chain is
+  required. No certificate-error bypass, HTTP production mode, or custom scheme
+  handler exists. Use a VPN for private-network access.
+- Main application navigation is origin-bound. Android also blocks cross-origin
+  subresource and POST requests before the network. External links need a native
+  choice; dangerous URI schemes are rejected. No exported deep-link receiver exists.
+- No `addJavascriptInterface` bridge or native credential store. Android blob
+  exports capture at most 25 MB / eight same-origin Blob references using an
+  origin-restricted document-start script, then pull bounded chunks with
+  `evaluateJavascript` only after a user chooses a destination. Every pull
+  rechecks origin and lifecycle. No blob fetch or CSP relaxation is used.
+- WebView/WKWebView owns persistent HttpOnly session cookies. Native code neither
+  handles passwords nor bypasses the server's CSRF rules. Native Android download
+  code obtains a cookie snapshot only for the configured origin and refuses redirects.
+- Live microphone, geolocation and media-capture requests are denied. The trusted
+  app's file input uses explicit system pickers; Android image capture delegates
+  to the camera app with a narrowly scoped content URI and no broad storage access.
+- External SSO uses a separate capability-restricted web view and the same OS
+  website cookie store. It does not gain app navigation/file handlers. iOS 18.4+
+  is required so uploads can be explicitly denied in that untrusted auth window.
+- Android backups/device transfer are excluded and screenshots are blocked.
+  iOS hides content when inactive and excludes temporary exports from backups.
+  OS-managed WKWebView storage remains governed by iOS device/backup protection;
+  do not assume the app can exclude every WebKit-managed cookie from an OS backup.
+- Server changes stop and destroy the old web context and erase website data.
+  Older Android engines that lack complete browsing-data deletion use an OS
+  app-data reset, which closes the app. A local wipe is not remote session revocation.
+- No app logs contain passwords, tokens, cookie headers or raw network exceptions.
+  System/browser diagnostics are outside the app's complete control.
+
+## Limitations and release gates
+
+The configured server and any server-installed extension are trusted same-origin
+code. An XSS or malicious administrator remains able to act as the signed-in user;
+native origin checks cannot fix compromised application content. Structural metadata
+probing does not authenticate the Yuvomi product or expose an anonymous version number.
+Embedded SSO providers that reject web views need a browser session instead; no
+secure native-session handoff exists upstream. A future handoff needs upstream
+review and single-use, short-lived, session-bound exchange semantics.
+
+Downloaded files saved by the user remain outside app erasure. Android network
+downloads are capped at 100 MB / 120 seconds; generated blob exports at 25 MB /
+45 seconds. iOS checks declared size before downloads and actual size before
+export (100 MB); an unknown/chunked size may consume disk before rejection.
+This resource-limit gap requires review and device testing before release.
+
+Android WebView Safe Browsing remains enabled. The installed engine/OS may perform
+its own security checks; this app does not implement or log those network services.
+Keep the OS and WebView patched. OSV advisory checks are build-time, never runtime,
+and do not prove the absence of vulnerabilities. See `docs/security-review.md`.