docs: security policy, accurate push and status notes, unreleased changelog

- SECURITY.md with the reporting address and expectations; README points to
  security@sepot.cz and security.txt
- README: FCM is the Android default since 1.2.0 when no UnifiedPush
  distributor is installed; status reflects the Play release
- the "F-Droid" channel is not available yet and is no longer listed
- CHANGELOG: unreleased fixes and security hardening
This commit is contained in:
Julius Joska
2026-10-09 14:05:39 +02:00
parent 94cfd72690
commit 00739ac8a0
4 changed files with 75 additions and 5 deletions
+1 -1
View File
@@ -26,7 +26,7 @@ their app-store status is documented in detail below.
Šepot relies on that stated position and, as an AGPL work, keeps its
complete corresponding source available under the AGPL through channels
without app-store restrictions (this public repository, F-Droid, direct
without app-store restrictions (this public repository, direct
APK). A written clarification for the current Rust `libsignal` has been
requested from Signal (tracking: <https://github.com/signalapp/libsignal/issues/684>).