Clean up repo: move docs to docs/, add SECURITY.md, .editorconfig, update README with badges, fix cross-references, correct documentation to reflect actual project state

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/pop_puller_to_gmail/sessions/71f26285-5584-42b2-8255-8ad2c9e9ecb4

SECURITY.md

@@ -0,0 +1,41 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+|---------|--------------------|
+| 2.x     | ✅ Yes             |
+| 1.x     | ❌ No              |
+| < 1.0   | ❌ No              |
+
+## Reporting a Vulnerability
+
+**Please do NOT open public issues for security vulnerabilities.**
+
+If you discover a security vulnerability, please report it responsibly:
+
+1. **Email**: Send details to the repository maintainer via the email listed on the [GitHub profile](https://github.com/christianlouis).
+2. **GitHub Private Vulnerability Reporting**: Use [GitHub's security advisory feature](https://github.com/christianlouis/pop_puller_to_gmail/security/advisories/new) to report privately.
+
+### What to Include
+
+- A description of the vulnerability
+- Steps to reproduce the issue
+- Potential impact
+- Suggested fix (if any)
+
+### Response Timeline
+
+- **Acknowledgment**: Within 48 hours
+- **Initial Assessment**: Within 1 week
+- **Fix & Disclosure**: Coordinated with the reporter
+
+## Security Best Practices for Users
+
+- **Never commit `.env` files** containing credentials
+- **Use App Passwords** for Gmail instead of your main password
+- **Enable 2FA** on all email accounts
+- **Rotate credentials** regularly
+- **Use SSL/TLS** for all mail connections
+- **Run containers as non-root** (default in provided Dockerfile)
+- **Keep dependencies updated** — Dependabot is enabled on this repository