- Add SECURITY.md: private disclosure via GitHub PVR or ruv@ruv.net, scope,
and response SLAs. Closes the responsible-disclosure gap raised in #320
(gives reporters a channel without enabling beg-bounty noise).
- mcp-brain-server CORS: add https://app.conceptmapping.org and
https://conceptmapping.org to the default allowlist so pi.ruv.io/v1/*
returns Access-Control-Allow-Origin for those browser origins (#560).
Kept an explicit per-origin allowlist (not `*`) since callers authenticate
with Bearer tokens. cargo check -p mcp-brain-server: clean.
Refs #320#560
Co-authored-by: ruv <ruvnet@users.noreply.github.com>
