docs: add a security policy and link it from About

SECURITY.md asks for private reports by email, encrypted to the
maintainer's OpenPGP key, and says where to fetch and check it. GitHub
shows it in the Security tab; About links to it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

5 files changed, 34 insertions, 0 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 92e01107..6c9c6fee 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [Unreleased]
+
+### Added
+
+-   About: "Report a security issue" links to the security policy, with the maintainer's OpenPGP key for private reports
+
 ## [0.3.4] - 2026-11-09
 
 ### Added
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..d8c1f25c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,23 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please report security issues privately, not on the public issue tracker.
+
+Email <danix@danix.xyz>, encrypted to the maintainer's OpenPGP key if you can:
+
+    110E 1B11 1BA2 C3C7 CCD1  27B8 F96B 36CA CC44 17AE
+
+Fetch it with either of these, and check that the fingerprint matches:
+
+    gpg --locate-keys danix@danix.xyz
+    gpg --keyserver hkps://keys.openpgp.org --recv-keys 110E1B111BA2C3C7CCD127B8F96B36CACC4417AE
+
+Include the HardenedPass version (Settings, About), the Android version, and the
+steps to reproduce.
+
+## Supported versions
+
+Only the latest release gets fixes. No app store delivers HardenedPass updates:
+install the newest APK from
+[GitHub Releases](https://github.com/danixland/HardenedPass/releases/latest).
diff --git a/app/src/main/java/app/passwordstore/ui/settings/AboutScreen.kt b/app/src/main/java/app/passwordstore/ui/settings/AboutScreen.kt
index 4a366390..6c20d3af 100644
--- a/app/src/main/java/app/passwordstore/ui/settings/AboutScreen.kt
+++ b/app/src/main/java/app/passwordstore/ui/settings/AboutScreen.kt
@@ -152,6 +152,9 @@ private fun AboutScreen(
     LinkRow(stringResource(R.string.about_changelog)) { onOpen(changelog) }
     LinkRow(stringResource(R.string.about_source)) { onOpen(REPOSITORY) }
     LinkRow(stringResource(R.string.about_issues)) { onOpen("$REPOSITORY/issues") }
+    LinkRow(stringResource(R.string.about_security)) {
+      onOpen("$REPOSITORY/blob/master/SECURITY.md")
+    }
     // White in both themes: the logo's dark outline disappears on a dark background, and Ko-fi
     // asks that the logo itself stays as it is.
     Button(
diff --git a/app/src/main/res/values-it/strings.xml b/app/src/main/res/values-it/strings.xml
index fed8adec..18065976 100644
--- a/app/src/main/res/values-it/strings.xml
+++ b/app/src/main/res/values-it/strings.xml
@@ -393,6 +393,7 @@
   <string name="about_changelog">Novità</string>
   <string name="about_source">Codice sorgente</string>
   <string name="about_issues">Segnala un problema</string>
+  <string name="about_security">Segnala un problema di sicurezza</string>
   <string name="about_support">Sostieni su Ko-fi</string>
   <string name="about_privacy_title">Privacy</string>
   <string name="about_privacy">Nessuna telemetria, nessuna analisi, nessun servizio Google. HardenedPass si collega solo al tuo server git, tramite il tuo proxy se ne imposti uno.</string>
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index a415e95f..ec2396be 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -427,6 +427,7 @@
   <string name="about_changelog">What\'s new</string>
   <string name="about_source">Source code</string>
   <string name="about_issues">Report a problem</string>
+  <string name="about_security">Report a security issue</string>
   <string name="about_support">Support on Ko-fi</string>
   <string name="about_privacy_title">Privacy</string>
   <string name="about_privacy">No telemetry, no analytics, no Google services. HardenedPass connects only to your git server, through your proxy if you set one.</string>