Import initial Hyprland HDMI recovery implementation

SECURITY.md

@@ -0,0 +1,38 @@
+# Security
+
+This project intentionally keeps almost all functionality unprivileged.
+
+## Privileged operation
+
+Only `chvt` requires root privileges. The recommended sudoers rule is limited to:
+
+```text
+/usr/bin/chvt
+```
+
+or, when the machine uses fixed VTs, to explicit arguments such as:
+
+```text
+/usr/bin/chvt 1
+/usr/bin/chvt 2
+```
+
+Do not configure unrestricted passwordless sudo for the user or for the recovery scripts.
+
+## Non-interactive sudo
+
+The recovery script always invokes sudo with `-n`:
+
+```bash
+sudo -n /usr/bin/chvt ...
+```
+
+This prevents the systemd user service from hanging on a password prompt.
+
+## Boot safety
+
+DRM hotplug events can occur during boot. The watcher therefore verifies that the current user has an active Wayland session with a valid VT before any recovery or VT switch is attempted.
+
+## Reporting security issues
+
+If this repository is published publicly, report security-sensitive findings privately through the repository owner's preferred security contact rather than opening a public issue containing exploitable details.