chore: add open-source community files and CI workflow

- LICENSE (MIT)
- SECURITY.md (vulnerability reporting policy)
- CONTRIBUTING.md (development setup and contribution guide)
- CI workflow (fmt, clippy, test on push/PR)
- Issue templates (bug report, feature request)
- Dependabot config (cargo + github-actions weekly)
- Cargo.toml workspace metadata (license, repository, description)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,47 @@
+name: Bug Report
+description: Report a bug in wx-cli
+labels: ["bug"]
+body:
+  - type: input
+    id: version
+    attributes:
+      label: wx-cli version
+      description: Output of `wx-cli --version`
+      placeholder: "wx-cli 0.7.2 (96ccbbd 2026-06-04)"
+    validations:
+      required: true
+  - type: input
+    id: macos-version
+    attributes:
+      label: macOS version
+      placeholder: "macOS 15.5 (Apple Silicon)"
+    validations:
+      required: true
+  - type: input
+    id: wechat-version
+    attributes:
+      label: WeChat version
+      placeholder: "4.1.8.29"
+    validations:
+      required: false
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: A clear description of the bug.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: The commands you ran and their output.
+      render: bash
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,18 @@
+name: Feature Request
+description: Suggest a new feature or improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem does this solve? What are you trying to do?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: How should this work?
+    validations:
+      required: false

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  fmt:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --check
+
+  clippy:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - run: cargo clippy -- -D warnings
+
+  test:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo test

CONTRIBUTING.md

@@ -0,0 +1,48 @@
+# Contributing
+
+Contributions are welcome! Here's how to get started.
+
+## Development Setup
+
+```bash
+# Clone the repo
+git clone https://github.com/pandorafuture/wx-cli.git
+cd wx-cli
+
+# Build
+cargo build
+
+# Run tests
+cargo test
+
+# Format & lint
+cargo fmt --check
+cargo clippy -- -D warnings
+```
+
+## Submitting Changes
+
+1. Fork the repository and create a feature branch.
+2. Make your changes with clear, focused commits.
+3. Ensure `cargo fmt`, `cargo clippy`, and `cargo test` all pass.
+4. Open a pull request with a description of what changed and why.
+
+## Bug Reports
+
+Open an [issue](https://github.com/pandorafuture/wx-cli/issues) with:
+
+- wx-cli version (`wx-cli --version`)
+- macOS version
+- WeChat version
+- Steps to reproduce
+- Expected vs actual behavior
+
+## Feature Requests
+
+Open an issue describing the use case and proposed solution. Discussion before implementation is encouraged for larger changes.
+
+## Code Style
+
+- Follow standard Rust conventions (`cargo fmt`).
+- Keep changes minimal and focused.
+- Add tests for new functionality when feasible.

Cargo.toml

@@ -5,3 +5,6 @@ resolver = "2"
 [workspace.package]
 version = "0.7.2"
 edition = "2021"
+license = "MIT"
+repository = "https://github.com/pandorafuture/wx-cli"
+description = "WeChat macOS database decryption and query tool"

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 pandorafuture
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+|---------|--------------------|
+| 0.7.x   | :white_check_mark: |
+| < 0.7   | :x:                |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in wx-cli, please report it responsibly:
+
+1. **Do NOT open a public issue.**
+2. Use [GitHub Private Vulnerability Reporting](https://github.com/pandorafuture/wx-cli/security/advisories/new) to submit your report.
+3. Include steps to reproduce, affected versions, and potential impact.
+
+You should receive an acknowledgment within 48 hours. We will work with you to understand the issue and coordinate a fix before any public disclosure.
+
+## Scope
+
+wx-cli handles sensitive data including:
+
+- WeChat database encryption keys
+- Decrypted chat messages and media
+- Local keystore files
+
+Security issues in any of these areas are treated with high priority.