Replace upstream Catch2 issue templates with Catch3-specific reports and security policy

3 files changed, 64 insertions, 41 deletions

diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index dbeff115..96d5d733 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,29 +1,41 @@
 ---
 name: Bug report
-about: Create an issue that documents a bug
-title: ''
-labels: ''
-assignees: ''
-
+about: Report a reproducible problem in Progmasoft Catch3
+title: "[Bug] "
 ---
 
-**Describe the bug**
-A clear and concise description of what the bug is.
+<!-- SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> -->
+<!-- SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1 -->
+
+Before filing, check the latest code and [current limitations](https://github.com/Progmasoft/catch3/blob/devel/docs/why-catch3.md). Catch3 is an independent project, not an official Catch2 release. Please do not post credentials or private test data. Send security vulnerabilities privately to support@progmasoft.com.
+
+### Affected surface
+
+- [ ] Catch3 addition (property checks, snapshots, results, or XML)
+- [ ] Catch2-compatible runner, assertion, or reporter
+- [ ] Build, installation, or packaging
+- [ ] Documentation
+
+### What happened?
+
+Describe the observed behavior and include the exact failure message. If the issue concerns the compatibility engine, say whether it also reproduces with upstream Catch2.
+
+### What did you expect?
+
+Describe the expected behavior and the contract or documentation that supports it.
 
-**Expected behavior**
-A clear and concise description of what you expected to happen.
+### Minimal reproduction
 
-**Reproduction steps**
-Steps to reproduce the bug.
-<!-- Usually this means a small and self-contained piece of code that uses Catch and specifying compiler flags if relevant. -->
+Provide a small C++20 test, the command used to build and run it, and the test-runner arguments. For a property failure, include the root seed, replay seed, trial number, and minimized counterexample when available. For a snapshot failure, describe the snapshot mode and file location without pasting private content.
 
+### Environment
 
-**Platform information:**
-<!-- Fill in any extra information that might be important for your issue. -->
- - OS: **Windows NT**
- - Compiler+version: **GCC v2.9.5**
- - Catch version: **v1.2.3**
+- Catch3 commit or release:
+- OS and architecture:
+- Compiler and version:
+- Build system and version (Bazel, CMake, Meson, Xmake, or Premake):
+- Relevant flags or configuration:
 
+### Additional context
 
-**Additional context**
-Add any other context about the problem here.
+Attach sanitized logs or screenshots if they help. State whether the problem reproduces on a clean checkout.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
index be9b9eea..488b5562 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -1,14 +1,28 @@
 ---
 name: Feature request
-about: Create an issue that requests a feature or other improvement
-title: ''
-labels: ''
-assignees: ''
-
+about: Propose an improvement to Progmasoft Catch3
+title: "[Feature] "
 ---
 
-**Description**
-Describe the feature/change you request and why do you want it.
+<!-- SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> -->
+<!-- SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1 -->
+
+Read [Catch3's scope and compatibility policy](https://github.com/Progmasoft/catch3/blob/devel/docs/why-catch3.md) before proposing a change. Catch3 additions and changes to the Catch2-compatible engine have different ownership and compatibility constraints.
+
+### Problem and use case
+
+What testing task is difficult today? Include a concrete example from a real test suite.
+
+### Proposed behavior
+
+Describe the user-facing API or runner behavior, with a short C++20 example if useful. Explain how failures should be reported and reproduced.
+
+### Ownership and compatibility
+
+- Does this belong in `Progmasoft::Catch3`, the compatibility engine, build tooling, or documentation?
+- Would it change existing Catch2 headers, macros, command-line behavior, or reporters?
+- Would it need compiled code, a new dependency, or a new minimum compiler version?
+
+### Alternatives and validation
 
-**Additional context**
-Add any other context or screenshots about the feature request here.
+What workaround exists today? What focused test would show that the proposed behavior works?
diff --git a/SECURITY.md b/SECURITY.md
index b66bf731..768a0212 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,19 +1,16 @@
-# Security Policy
+<!-- SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> -->
+<!-- SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1 -->
 
-## Supported Versions
+# Security policy
 
-* Versions 1.x (branch Catch1.x) are no longer supported.
-* Versions 2.x (branch v2.x) are currently supported.
-* `devel` branch serves for stable-ish development and is supported,
-  but branches `devel-*` are considered short lived and are not supported separately.
+Progmasoft Catch3 is an independent fork, not an official Catch2 release. Security reports for this repository must go to Progmasoft, not to upstream Catch2 maintainers.
 
+## Supported code
 
-## Reporting a Vulnerability
+We triage reports against the current `devel` branch and the latest tagged Catch3 release. Older tags and upstream Catch2 branches are not separately maintained here. A fix may be released or documented without a backport to every earlier tag.
 
-Due to its nature as a _unit_ test framework, Catch2 shouldn't interact
-with untrusted inputs and there shouldn't be many security vulnerabilities
-in it.
+## Private reporting
 
-However, if you find one you send email to martin <dot> horenovsky <at>
-gmail <dot> com. If you want to encrypt the email, my pgp key is
-`E29C 46F3 B8A7 5028 6079 3B7D ECC9 C20E 314B 2360`.
+Email **support@progmasoft.com** with a concise description, affected revision, minimal reproduction, impact, and a safe way to reach you. Do not include credentials, private test fixtures, or exploit details in a public issue. We will coordinate disclosure after validating the report and preparing a fix or mitigation.
+
+If the same flaw independently affects unmodified upstream Catch2, report it to its maintainers through their current security policy as a separate disclosure. Do not assume a Catch3 report reaches upstream.