chore: added contribute, license and security files

Author: Praashh

CONTRIBUTING.md

@@ -0,0 +1,75 @@
+# Contributing to Helix
+
+Thanks for your interest in contributing to Helix! This guide will help you get started.
+
+## Getting Started
+
+1. **Fork** the repository and clone your fork
+2. **Install dependencies:**
+   ```bash
+   bun install
+   ```
+3. **Set up environment variables:** Copy `.env.example` to `.env` and fill in the required values (see `lib/env.ts` for the full list)
+4. **Set up the database:**
+   ```bash
+   npm run db:generate
+   npm run db:migrate
+   ```
+5. **Start the dev server:**
+   ```bash
+   npm run dev
+   ```
+
+## Development Workflow
+
+1. Create a new branch from `main`:
+   ```bash
+   git checkout -b feat/your-feature
+   ```
+2. Make your changes
+3. Run linting and formatting:
+   ```bash
+   npm run lint
+   npm run format
+   ```
+4. Ensure the project builds:
+   ```bash
+   npm run build
+   ```
+5. Commit your changes and open a pull request
+
+## Code Style
+
+- **Formatting/Linting:** Biome handles all formatting and linting. Run `npm run lint` before committing.
+- **Imports:** Use the `@/` path alias. Use `import type` for type-only imports.
+- **TypeScript:** Strict mode is enabled. Avoid `any`; prefer `unknown` with type guards.
+- **Components:** Use named exports, PascalCase for component names, and `"use client"` only when needed.
+- **CSS:** Use Tailwind utility classes. Merge classNames with `cn()` from `@/lib/utils`.
+
+See `CLAUDE.md` for the full code style guidelines and architecture overview.
+
+## Pull Requests
+
+- Keep PRs focused — one feature or fix per PR
+- Write a clear title and description explaining what changed and why
+- Ensure `npm run build` passes before submitting
+- Link any related issues
+
+## Reporting Bugs
+
+Open an issue with:
+- A clear description of the bug
+- Steps to reproduce
+- Expected vs actual behavior
+- Browser/OS/Node version if relevant
+
+## Suggesting Features
+
+Open an issue describing:
+- The problem you're trying to solve
+- Your proposed solution
+- Any alternatives you've considered
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the [MIT License](LICENSE).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Helix
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Helix, please report it responsibly.
+
+**Do not open a public issue.** Instead, please email the maintainers directly with:
+
+- A description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Any suggested fixes (optional)
+
+We will acknowledge your report within 48 hours and aim to provide a fix or mitigation within 7 days for critical issues.
+
+## Security Considerations
+
+Helix handles the following sensitive data:
+
+- **Authentication:** Managed by Clerk. User sessions and credentials are never stored directly.
+- **API Keys:** Google AI API keys and other secrets are stored as environment variables, never committed to the repository.
+- **Database:** PostgreSQL via Prisma. All API routes authenticate requests through Clerk before accessing data.
+- **Webhooks:** Clerk webhooks are verified using Svix signatures.
+
+## Best Practices for Contributors
+
+- Never commit `.env` files, API keys, or credentials
+- Use parameterized queries (Prisma handles this by default)
+- Validate and sanitize all user input at API boundaries
+- Keep dependencies up to date