chore: open-source readiness — fix repo metadata, add SECURITY/SUPPORT (#3)

Prep the repo for going public:
- Fix package.json repository/bugs/homepage URLs (pointed at a non-existent
  github.com/bitbybit/marketing-cli slug) to github.com/BitByBit-B3/marketing.
- Fix the BitByBit org link and the clone URL placeholder in the README.
- Add SECURITY.md (private vuln reporting via GitHub advisories) and SUPPORT.md.
- Rename root workspace package @bitbybit/marketing-cli -> @b3/marketing for
  scope consistency with the @b3/* packages.

Verified: pnpm install --frozen-lockfile, typecheck, and the full test suite
(104 tests, incl. brand-guard + catalog:check) all pass.

Author: Thanukamax

CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to this project will be documented in this file.
 
 The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- `SECURITY.md` — private vulnerability reporting policy (GitHub Security Advisories).
+- `SUPPORT.md` — where to ask questions and file issues.
+
+### Fixed
+
+- Corrected `repository`, `bugs`, and `homepage` URLs in `package.json` to point at
+  `github.com/BitByBit-B3/marketing` (they referenced a non-existent slug).
+- Fixed the BitByBit org link and the clone URL in the README.
+
+### Changed
+
+- Renamed the root workspace package to `@b3/marketing` for scope consistency with
+  the `@b3/*` workspace packages.
+
 ## [0.1.0] — 2026-05-19
 
 Initial open-source release.

README.md

@@ -2,7 +2,7 @@
 
 Agent-driven social images. Type a JSON brief, get an on-brand PNG.
 
-Ships themed for [BitByBit (B3)](https://github.com/bitbybit) — the team that built it. Fork the repo, edit `brand.config.ts`, and the same templates render in your brand.
+Ships themed for [BitByBit (B3)](https://github.com/BitByBit-B3) — the team that built it. Fork the repo, edit `brand.config.ts`, and the same templates render in your brand.
 
 ## Why this exists
 
@@ -13,7 +13,7 @@ Most AI image generation goes off-brand the second you stop watching. This tool
 Requirements: Node 22+, pnpm 9+ (brand-guard uses the still-experimental `node:fs/promises` glob, which lands as stable in Node 22).
 
 ```bash
-git clone <this-repo>
+git clone https://github.com/BitByBit-B3/marketing.git
 cd marketing
 pnpm install
 pnpm marketing render hero-card --data examples/hero-card.json --format square --out ./out

SECURITY.md

@@ -0,0 +1,41 @@
+# Security Policy
+
+## Supported versions
+
+This project is pre-1.0 and ships from `main`. Security fixes land on `main` and
+in the latest release. Older tagged releases are not separately patched.
+
+| Version | Supported |
+| ------- | --------- |
+| `main` / latest `0.x` | ✅ |
+| older `0.x` tags | ❌ |
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for security problems.**
+
+Report privately through GitHub's **["Report a vulnerability"](https://github.com/BitByBit-B3/marketing/security/advisories/new)**
+button (repository → **Security** → **Advisories**). If you can't use GitHub
+Security Advisories, email **engineering@bbyb.dev** with the details instead.
+
+Please include:
+
+- A description of the issue and its impact.
+- Steps to reproduce, ideally with a minimal JSON brief or command.
+- The version / commit and your environment (Node version, OS).
+
+## What to expect
+
+- We aim to acknowledge a report within **5 business days**.
+- We'll confirm the issue, work on a fix, and keep you updated on progress.
+- Once a fix is released, we're happy to credit you in the advisory unless you
+  prefer to stay anonymous.
+
+## Scope notes
+
+This is a local, offline image-rendering CLI: it takes a JSON brief and bundled
+fonts and produces a PNG. It does not make network calls at runtime and does not
+handle user accounts or secrets. The most relevant concerns are things like
+denial-of-service or resource exhaustion from crafted input, or a way to make
+the renderer write outside its intended output path. Reports along those lines
+are especially welcome.

SUPPORT.md

@@ -0,0 +1,34 @@
+# Support
+
+Thanks for using the Marketing CLI. Here's the fastest way to get unstuck.
+
+## Before you ask
+
+- Read the [README](./README.md) — the Quickstart, **Errors**, and **How it works**
+  sections cover most questions.
+- Run the built-in discovery commands:
+  ```bash
+  pnpm marketing list                # all templates and their formats
+  pnpm marketing schema <template>   # the exact JSON a template expects
+  ```
+- Most failures are reported as JSON on stdout with an `error.code` and an
+  `error.hint`. Start there — the hint usually names the field to fix.
+
+## Questions and ideas
+
+- **How-to / usage questions:** open a [GitHub issue](https://github.com/BitByBit-B3/marketing/issues)
+  using a clear title. Include the command you ran and the full JSON output.
+- **Bug reports:** use the **Bug report** issue template and include a **minimal
+  reproducible JSON brief**, the command, and your Node version / OS.
+- **New template or format requests:** use the **Template request** issue
+  template. We discuss design in the issue before any code (see
+  [CONTRIBUTING.md](./CONTRIBUTING.md)).
+
+## Security
+
+Do **not** report security issues in public issues. Follow the
+[Security Policy](./SECURITY.md) instead.
+
+## Conduct
+
+All participation is covered by our [Code of Conduct](./CODE_OF_CONDUCT.md).

package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@bitbybit/marketing-cli",
+  "name": "@b3/marketing",
   "version": "0.1.0",
   "description": "Agent-driven, on-brand social images. Type a JSON brief, get a deterministic PNG.",
   "license": "MIT",
@@ -11,12 +11,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/bitbybit/marketing-cli.git"
+    "url": "https://github.com/BitByBit-B3/marketing.git"
   },
   "bugs": {
-    "url": "https://github.com/bitbybit/marketing-cli/issues"
+    "url": "https://github.com/BitByBit-B3/marketing/issues"
   },
-  "homepage": "https://github.com/bitbybit/marketing-cli#readme",
+  "homepage": "https://github.com/BitByBit-B3/marketing#readme",
   "keywords": [
     "marketing",
     "social-images",