Add SECURITY.md and AUDITS.md

Both are prerequisites for any external review programme, and one of them was already
promised by our live security.txt to a file that did not exist.

SECURITY.md states the scope, the response times we hold ourselves to, and three things
we would rather a reviewer heard from us than discovered: there has been no third-party
audit, every validator is operated by the Foundation, and the post-quantum guarantee is
at anchor heights rather than on every block.

AUDITS.md opens by saying we have had no third-party audit, and keeps that first line
until it stops being true.

AUDITS.md

@@ -0,0 +1,59 @@
+# Security audits and reviews
+
+**AERE Network has had no third-party security audit.** That is the first line of this page on
+purpose, and it stays here until it is no longer true. Everything below describes what we have
+verified ourselves, which is a weaker thing, and we do not want the difference blurred.
+
+Last updated: 2026-09-01.
+
+---
+
+## External audits
+
+| scope | auditor | date | report |
+|---|---|---|---|
+| — | none | — | — |
+
+There is nothing to put in this table yet. When there is, the full report goes here, including any
+findings we chose not to fix and why.
+
+## What we have done instead, and what it is worth
+
+- **Continuous self-verification.** The chain's live properties are re-measured automatically rather
+  than asserted in prose: validator set size, quorum, the post-quantum anchor threshold, the base-fee
+  floor, backup coverage, and the public verifier. A claim that stops being true shows up as a failed
+  check, not as stale documentation. This is real, and it is still *us checking us*.
+- **Negative controls on every gate.** A check that has never been shown to fail is not evidence. For
+  each safety-relevant check we plant the defect it is supposed to catch and require it to go red,
+  then restore the source and require it to go green. A check that cannot fail is treated as broken.
+- **A reproducibility package prepared for an external reviewer.** The consensus code under review,
+  a threat model naming the attack surfaces we consider realistic, a pinned reproduce guide, and a
+  manifest of file hashes. It is ready to hand over.
+- **Independent verification by a second implementation.** The post-quantum anchor certificates on
+  the live chain are validated by a second client, written in a different language on a different
+  codebase, which reaches its own verdict on every anchor.
+
+**None of that is an audit.** Self-verification finds the mistakes you thought to look for.
+
+## Verify the chain yourself, without trusting us
+
+The post-quantum anchor is designed so you do not have to take our word for it: from block
+13,014,000, every 32nd block carries a Falcon-512 certificate, and the block hash covers it. From
+block 14,961,456 that certificate requires at least six valid seals out of nine. The verifier is
+public, the signatures are in the headers, and the check runs against any node — ours or your own.
+
+## Reporting a vulnerability
+
+Report to **security@aere.network**, or see <https://aere.network/security> for the full policy.
+
+- We aim to acknowledge within 72 hours.
+- Public credit on this page unless you ask to remain anonymous.
+- We will not pursue legal action against good-faith research conducted under the published policy.
+- If a report leads to a fix, the fix and the finding are published here together, including the
+  window during which the issue was live.
+
+## What this page will never do
+
+It will not describe a self-review as an audit, and it will not report a fix as complete before it
+has been verified on the live chain. If you find a claim on this page that you can measure and
+disprove, that itself is a valid security report, and we would like to receive it.

SECURITY.md

@@ -0,0 +1,45 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Report privately to **security@aere.network**. Do not open a public issue for a security problem.
+
+- We aim to acknowledge within **72 hours**.
+- We will tell you whether we consider the report in scope, and why, within **7 days**.
+- We will not pursue legal action against good-faith research conducted under this policy.
+- Public credit on [AUDITS.md](https://aere.network/AUDITS.md) unless you ask to stay anonymous.
+
+The canonical, always-current policy is <https://aere.network/security>, and the machine-readable
+pointer is <https://aere.network/.well-known/security.txt>.
+
+## In scope
+
+- Consensus for AERE chain **2800**: the QBFT implementation, the post-quantum anchor certificate,
+  and the post-quantum layers on consensus messages.
+- The post-quantum precompiles (`0x0AE1`–`0x0AE5`) and the code that dispatches to them.
+- Node RPC surfaces exposed publicly.
+- Solidity contracts deployed by the Foundation.
+
+## Out of scope
+
+- Denial of service by traffic volume against public endpoints.
+- Findings that require physical access to Foundation hardware or a Foundation private key.
+- Reports generated by automated scanners with no demonstrated impact on this chain.
+
+## What we will tell you honestly
+
+- **There has been no third-party security audit of this project.** See
+  [AUDITS.md](https://aere.network/AUDITS.md). Everything verified so far is us checking ourselves,
+  which is weaker, and we do not describe it as an audit.
+- **All validators are operated by the Foundation.** The number of independent parties who would
+  have to agree to halt this chain is one. No amount of cryptography changes that number, and a
+  report pointing at the consequences of that fact is in scope and welcome.
+- **The post-quantum guarantee is at anchor heights**, not on every block: from block 13,014,000,
+  every 32nd block carries a Falcon-512 certificate under the block hash, requiring at least six
+  valid seals out of nine from block 14,961,456. Blocks between anchors rest on ECDSA. We correct
+  over-claims publicly when we find them, and we have done so before.
+
+## Fixes
+
+When a report leads to a fix, we publish the finding, the fix, and the window during which the
+issue was live — including anything we chose not to fix, and why.