Split the trademark policy out of LICENSE, and stop calling the project proprietary (#37)

Author: WhiteStarSupreme

.github/workflows/release.yml

@@ -111,6 +111,8 @@ jobs:
             setup.py \
             README.md \
             LICENSE \
+            TRADEMARK.md \
+            SECURITY.md \
             --exclude="*.pyc" \
             --exclude="__pycache__/*" \
             --exclude="*.DS_Store" \

Dockerfile

@@ -2,7 +2,7 @@ FROM python:3.12.11-slim@sha256:47ae396f09c1303b8653019811a8498470603d7ffefc29cb
 
 WORKDIR /app
 
-COPY setup.py README.md LICENSE bootstrap-linux.sh bootstrap-macos.sh bootstrap-windows.ps1 Dockerfile .dockerignore /app/
+COPY setup.py README.md LICENSE TRADEMARK.md SECURITY.md bootstrap-linux.sh bootstrap-macos.sh bootstrap-windows.ps1 Dockerfile .dockerignore /app/
 COPY src/ /app/src/
 COPY tests/ /app/tests/
 COPY packages/ /app/packages/

LICENSE

@@ -17,7 +17,7 @@ Designed for **long-term cold storage** of critical secrets: recovery credential
 
 **Why distributed?**
 
-- Fewer than K shares reveal **nothing**: information-theoretic security *(same as Trezor SLIP-39, ICANN DNSSEC ceremonies)*
+- Fewer than K shares reveal **nothing**: the key-split has information-theoretic security *(same as Trezor SLIP-39, ICANN DNSSEC ceremonies)*; the file itself stays sealed under AES-256-GCM
 - No single point of failure: distribute shares across people, locations, media. No $5 Wrench Attack
 - Works completely offline in air-gapped environments
 
@@ -118,6 +118,8 @@ Submit a pull request or open an issue.
 
 ## License
 
-Fractum is licensed under a Custom Proprietary Software License that permits personal, non-commercial use. Commercial use is not permitted.
+Fractum is **Apache-2.0**. You may use it, modify it, redistribute it and use it commercially, without asking anyone.
 
-📄 **[View Full License](LICENSE)**
+The name is separate: Apache-2.0 grants no trademark rights (section 6), so "Fractum", the logos and the associated marks stay with S.A.S.U. KATVIO. Fork the code freely, give your fork its own name.
+
+📄 **[LICENSE](LICENSE)** · **[TRADEMARK.md](TRADEMARK.md)** · **[SECURITY.md](SECURITY.md)**

README.md

@@ -0,0 +1,53 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Report privately, not in a public issue: **contact@katvio.com**, with
+`SECURITY` in the subject line.
+
+A dedicated `security@katvio.com` alias would be better, and does not exist
+today; `contact@katvio.com` is the only address the project publishes.
+
+Include the version, the platform, and the smallest set of steps that
+reproduces the problem. A proof of concept helps but is not required.
+
+What to expect:
+
+| Step | Delay |
+|---|---|
+| Acknowledgement of receipt | 3 working days |
+| First assessment, severity and whether it is accepted | 10 working days |
+| Fix or documented mitigation for an accepted critical report | 90 days |
+
+If you get no acknowledgement within the first delay, the address may be
+failing; open a public issue saying only that you are trying to reach the
+security contact, without any detail of the finding.
+
+We ask for the usual restraint in return: no disclosure before a fix is
+available or the 90 days have passed, whichever comes first, and no testing
+against systems you do not own.
+
+## Supported versions
+
+Fixes land on the latest released minor version. Older versions receive nothing,
+so an upgrade is part of any remediation.
+
+## What this software does and does not claim
+
+Fractum encrypts a file with AES-256-GCM and splits the encryption key into
+shares using Shamir's Secret Sharing. It is a command line tool that runs
+offline, by design.
+
+Two limits are worth stating plainly, because they are the ones that surprise
+people:
+
+- **The share files are only as safe as where you put them.** The threshold
+  protects against losing some of them, not against an attacker who collects
+  enough of them. Storing several shares in one place removes the protection
+  entirely.
+- **The machine that runs the tool sees the key in memory.** Fractum is designed
+  for an offline, trusted workstation. Running it on a shared or compromised
+  host defeats the point.
+
+Cryptographic export and import rules vary by country. Using or redistributing
+this software is the user's responsibility in their own jurisdiction.