chore: license code under MIT and docs under CC BY 4.0, add a security policy

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Terminal49, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -87,4 +87,14 @@ Use conventional commit prefixes (`docs:`, `feat:`, `fix:`, `chore:`), and keep
 
 This is a public repository. Never commit API keys, secrets, or customer data. Use placeholders such as `Token YOUR_API_KEY` in examples.
 
-To report a security issue, email [support@terminal49.com](mailto:support@terminal49.com).
+To report a security issue privately, see [SECURITY.md](SECURITY.md).
+
+## License
+
+Copyright (c) 2026 Terminal49, Inc.
+
+- **Code and the API spec: [MIT](LICENSE).** This covers everything outside `docs/`, including the SDK, CLI, MCP server, gateway, and tooling, plus the OpenAPI spec at [`docs/openapi.json`](docs/openapi.json) and the Postman collection generated from it.
+- **Documentation: [CC BY 4.0](docs/LICENSE).** This covers everything else in `docs/`, including the guides, reference pages, and images. When you reuse it, credit "Terminal49, Inc." and link to [terminal49.com/docs](https://terminal49.com/docs).
+- **Not licensed:** the Terminal49 name and logos, including [`docs/logos/`](docs/logos/) and [`public/store-icons/`](public/store-icons/). Third-party material, such as map data shown in screenshots, keeps its own terms. Vendored code under [`tools/oxlint/anti-slop/`](tools/oxlint/anti-slop/) keeps its own license.
+
+Contributions are accepted under the same terms: code under MIT, documentation under CC BY 4.0.

SECURITY.md

@@ -0,0 +1,18 @@
+# Security policy
+
+## Report a vulnerability
+
+Report security issues privately. Do not open a public issue or pull request.
+
+- Preferred: use GitHub's [private vulnerability reporting](https://github.com/Terminal49/API/security/advisories/new) for this repository.
+- Or email [support@terminal49.com](mailto:support@terminal49.com) with "Security" in the subject.
+
+Include what you found, the steps to reproduce it, and the affected component, such as the API, the MCP server at `mcp.terminal49.com`, the TypeScript SDK, or the CLI. We acknowledge reports and keep you informed while we investigate.
+
+## Scope
+
+This repository contains the public API docs, the OpenAPI spec, the TypeScript SDK (`@terminal49/sdk`), the CLI (`@terminal49/cli`), and the MCP server with its OAuth gateway. We support the latest published version of each package.
+
+## Secrets
+
+Never commit API keys, tokens, or customer data. Secret scanning and push protection are enabled on this repository. If you commit a credential by mistake, revoke it in the [developer portal](https://app.terminal49.com/developers/api-keys) and tell us.