docs: reorder role block, add SECURITY/CODE_OF_CONDUCT

CODE_OF_CONDUCT.md

@@ -0,0 +1,16 @@
+# Code of Conduct
+
+## Our Standards
+
+- Be respectful, direct, and evidence-oriented in issues, pull requests, reviews, and discussions.
+- Assume technical disagreement is about the work. Keep feedback specific to code, docs, data, evidence, reproducibility, or operational risk.
+- Avoid harassment, insults, discriminatory language, personal attacks, and repeated off-topic comments.
+- Do not pressure maintainers or contributors to disclose private account details, credentials, trading records, unpublished data, or personal information.
+
+## Project Scope
+
+`CnEquityStrategies` is a strategy-library repository: it holds A-share strategy implementations, manifests, and catalog metadata that downstream platform repositories consume. Contributions should keep research and backtest claims conservative and verifiable, separate research evidence from live-trading decisions, and avoid presenting examples as investment advice. Broker credentials, order execution, and other live-system concerns belong to the consuming platform repositories; discussions that touch them should stay measured, reproducible, and evidence-based rather than speculative.
+
+## Reporting and Enforcement
+
+Report conduct concerns to the maintainer on GitHub: `@Pigbibi`. Maintainers may edit or remove comments, close issues or pull requests, restrict participation, or take other reasonable steps to protect contributors and project integrity.

README.md

@@ -1,14 +1,5 @@
 # CnEquityStrategies
 
-
-## QSL architecture role
-
-- **Layer**: `strategy-library`.
-- **Responsibility**: A-share strategy implementation package.
-- **Owns**: runtime-enabled strategy code, manifests, catalog metadata.
-- **Consumes**: QuantPlatformKit and validated snapshot artifacts.
-- **Must not**: connect to brokers or deploy live services.
-
 [Chinese README](README.zh-CN.md)
 
 > Investing involves risk. This project does not provide investment advice and is for education, research, and engineering review only.
@@ -19,6 +10,14 @@
 
 This repository is a strategy layer, not a broker or deployment layer. It does not store broker credentials, submit orders by itself, publish snapshot artifacts, or decide whether a profile is safe for live trading without external evidence.
 
+## QSL architecture role
+
+- **Layer**: `strategy-library`.
+- **Responsibility**: A-share strategy implementation package.
+- **Owns**: runtime-enabled strategy code, manifests, catalog metadata.
+- **Consumes**: QuantPlatformKit and validated snapshot artifacts.
+- **Must not**: connect to brokers or deploy live services.
+
 ## Current runtime surface
 
 ### Direct runtime strategies

README.zh-CN.md

@@ -1,14 +1,5 @@
 # CnEquityStrategies
 
-
-## QSL 架构角色
-
-- **层级**：`策略库`。
-- **职责**：A 股策略实现包。
-- **事实源/归属**：runtime-enabled 策略代码、manifests、catalog metadata。
-- **消费对象**：QuantPlatformKit 和已验证快照 artifacts。
-- **禁止事项**：连接券商或部署 live 服务。
-
 [English README](README.md)
 
 > 投资有风险。本项目不构成投资建议，仅用于学习、研究和工程审阅。
@@ -19,6 +10,14 @@
 
 这是策略层，不是券商或部署层。本仓库不保存券商凭据，不自行下单，不发布 snapshot artifact，也不能在缺少外部证据的情况下决定某个 profile 是否适合 live。
 
+## QSL 架构角色
+
+- **层级**：`策略库`。
+- **职责**：A 股策略实现包。
+- **事实源/归属**：runtime-enabled 策略代码、manifests、catalog metadata。
+- **消费对象**：QuantPlatformKit 和已验证快照 artifacts。
+- **禁止事项**：连接券商或部署 live 服务。
+
 ## 当前 runtime 面
 
 ### 普通 runtime 策略

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+Thanks for helping keep `CnEquityStrategies` safe.
+
+This repository is an A-share strategy-library package: it owns strategy implementations, manifests, and catalog metadata for downstream platform repositories. It does not store broker credentials, submit orders, or connect to brokers itself. Please do not open a public issue for a vulnerability; report it privately instead.
+
+## Reporting a Vulnerability
+
+- Contact the maintainer directly at GitHub: `@Pigbibi`.
+- Private vulnerability reporting is not currently enabled for this repository, so please report by direct contact rather than through GitHub's advisory flow.
+- Include the repository name, affected commit or branch, environment details, and exact reproduction steps.
+
+## Secret and Credential Exposure
+
+This repository should never contain broker credentials, account identifiers, or private order data. If you find any committed secrets, tokens, or other sensitive material:
+
+1. Report it privately rather than filing a public issue.
+2. Note the exact file and commit so it can be purged, and rotated if it corresponds to a live credential.
+3. Share only the minimum evidence needed to reproduce the issue.
+
+## Scope Notes
+
+Security fixes should stay minimal and focused. Please avoid bundling unrelated refactors with a security report or patch.