docs: dependencies and security policy

README.md

@@ -70,6 +70,19 @@ Solidity 0.8.24 with the optimizer on: 200 runs for the V3 tree, 1 run for the V
 tree, `viaIR` enabled. Each contract's exact verified build lives on https://etherscan.io;
 this repo is the plain-source mirror.
 
+## Dependencies
+
+The contracts build against the canonical Uniswap deployments on each chain. There's no forked or vendored AMM code in this repo; only the interfaces they call are kept in-tree (`dtm-v4/contracts/interfaces`).
+
+- Uniswap V3: [v3-core](https://github.com/Uniswap/v3-core) and [v3-periphery](https://github.com/Uniswap/v3-periphery)
+- Uniswap V4: [v4-core](https://github.com/Uniswap/v4-core) (PoolManager)
+
+The router, quoter, and pool-manager addresses for each chain are listed in `chains/`.
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for the security model, the design tradeoffs, and how to report a vulnerability.
+
 ## License
 
 MIT

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Email dev@qian.ag with the details and a proof of concept if you have one. Report privately and give us time to ship a fix before you disclose it publicly.
+
+## Security model
+
+- **Immutable locker.** `QianLocker` holds the launch LP position and has no withdrawal function. Nobody can pull the liquidity.
+- **No proxies or upgrades.** Every contract ships as final bytecode. The controller can repoint the treasury, fee sink, and hook whitelist, but no one can swap the contract logic.
+- **Renounced tokens.** A launched token's `owner()` is the zero address. It has no mint, pause, blacklist, or transfer hook.
+- **Permissionless fees.** Anyone can call `QianFeeRouter.collectFees(token)`. It pays the creator and treasury on a fixed split and moves no user funds.
+- **Launch integrity.** `GuardHook` lets only the factory initialize a pool, so nobody can front-run a launch and brick it. It runs no trade-time logic.
+
+## Accepted design tradeoffs
+
+- **Liquidity stays locked forever.** There is no unlock, migration, or emergency withdrawal path anywhere in the code.
+- **No launch-time trading protections.** No dead window, wallet cap, or anti-snipe tax. Every swap-time hook flag reads false.
+- **Fee liquidation has no slippage floor.** `collectFees` swaps the platform's token-side share to WETH in the same call with no minimum-out. The amounts are tiny, and only the treasury's own revenue is exposed, never user or creator funds.
+
+## Scope
+
+Contracts under `dtm-v3/contracts` and `dtm-v4/contracts`, deployed on Robinhood Chain, Base, and Ethereum. We verify every core contract's source on each chain's block explorer.