docs: point the README at SECURITY.md and disambiguate the two security docs

A reader looking for where to report a flaw had no path from the README: the
only security row led to docs/security.md, which is the design rationale, not
a reporting channel. That row is now "Security design", and a line under the
table sends vulnerability reports to SECURITY.md instead of the issue tracker.

development.md gains SECURITY.md in its user-facing deliverables table and
drops "internal" from the roadmap row, which stopped being true when the
roadmap was reframed for outside readers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -21,6 +21,11 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   unchanged: same requirements, same accepted risks, same ADR. The reviewing
   model is no longer named in the text; the fact that a pre-release review ran,
   and its date, stay.
+- The README documentation table now points at `SECURITY.md` for reporting a
+  vulnerability, and the `docs/security.md` row is renamed *Security design* —
+  with two files a reader could reasonably call "security", the table said
+  which is which only by accident. `development.md` lists `SECURITY.md` among
+  the user-facing deliverables and no longer calls the roadmap internal.
 - [docs/roadmap.md](docs/roadmap.md) is now in English, with a short note on
   how to read it from outside the project: nothing in it is a commitment, there
   are no dates, and the stated order is a recommendation. The model assigned to

README.md

@@ -35,11 +35,14 @@ send log and DNS checks in the panel, encrypted backups.
 | [**Operator guide**](docs/guide.md) | Reverse proxy, environment variables, DNS, IP warmup, panel operations, rate limiting, backup/restore, ports, image tag |
 | [Product boundaries](docs/product.md) | Purpose, deployment assumptions, out-of-scope items, multi-domain model |
 | [Architecture](docs/architecture.md) | As-built technical design |
-| [Security](docs/security.md) | Accepted security trade-offs and requirements |
+| [Security design](docs/security.md) | Mandatory requirements, accepted risks, the CSRF ADR |
 | [Development](docs/development.md) | Building, testing, docs rules, model routing, commits |
 | [Roadmap](docs/roadmap.md) | Open work (1.x+) — direction, not commitments |
 | [CHANGELOG](CHANGELOG.md) | Release history |
 
+Found a vulnerability? Do not open an issue — [SECURITY.md](SECURITY.md) has
+the private reporting channel and the scope.
+
 Repository: <https://github.com/mixeme/selfpost> — source, issues, releases, and
 the `ghcr.io/mixeme/selfpost` image.
 

docs/development.md

@@ -276,7 +276,7 @@ There is no `docs/archive/` directory.
 | As-built design | [architecture.md](architecture.md) |
 | Development process (this file) | [development.md](development.md) |
 | Security requirements and accepted risks | [security.md](security.md) |
-| Internal roadmap (1.x+) | [roadmap.md](roadmap.md) |
+| Roadmap (1.x+) | [roadmap.md](roadmap.md) |
 | Active design plans | [plans/](plans/) |
 | Release history | [CHANGELOG.md](../CHANGELOG.md) |
 
@@ -286,6 +286,7 @@ There is no `docs/archive/` directory.
 |---|---|
 | [README.md](../README.md) | Overview, requirements, quick start, docs index, reference deploy, licence |
 | [guide.md](guide.md) | Proxy, env, DNS, IP warmup, operations, rate limiting, backup, ports, image tag |
+| [SECURITY.md](../SECURITY.md) | Private reporting channel, supported versions, scope |
 | [LICENSE](../LICENSE) | AGPL-3.0 full text |
 | [deploy/docker-compose.yml](../deploy/docker-compose.yml) + proxies | Apache + nginx/Caddy/Traefik under [deploy/](../deploy/) |
 | [deploy/.env.example](../deploy/.env.example) | Public env template; full reference in [guide.md](guide.md) |