chore: add public-repo readiness files (CODEOWNERS, LICENSE, Socket scan) (#4)

* chore: add public-repo readiness files

Prerequisites for making the repo public per the WorkOS runbook
for shipping public-facing repositories, mirroring authkit-nextjs:

- CODEOWNERS assigning the repo to @workos/dx
- MIT LICENSE plus README License and Contributing sections
- Daily Socket tier-1 vulnerability scan workflow
- Bug report issue template adapted for Electron
  (OS, Electron version, sign-in ceremony)

* ci: harden the Socket scan workflow

Security review of the workflow (originally a verbatim copy from
authkit-nextjs) flagged three issues:

- Script injection: distinct_id was interpolated directly into a
  run: block; pass it through the DISTINCT_ID env var instead so
  workflow_dispatch input can't inject shell commands.
- Supply chain: npm install -g socket floated the latest release;
  pin to socket@1.1.145 since the CLI runs adjacent to
  SOCKET_SECURITY_API_TOKEN.
- Excessive permissions: no permissions block meant default token
  grants; add top-level contents: read, as checkout is the only
  GitHub API use.

* style: move packageManager to oxfmt's canonical position

PR #3 placed "packageManager" after "description" (matching
authkit-nextjs), but oxfmt sorts package.json keys canonically and wants
it last — so `format:check` fails on main and on every PR's merge ref.
PR #3's own CI caught this but was merged before the check was read.

Author: nicknisi

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# See GitHub's docs for more details:
+# https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
+
+# DX Team
+* @workos/dx

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,34 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Environment (please complete the following information):**
+
+- OS: [e.g. macOS 15.5, Windows 11]
+- authkit-electron version [e.g. 0.1.0]
+- Electron version [e.g. 37.2.0]
+- Sign-in ceremony [system-browser or window]
+
+**Additional context**
+Add any other context about the problem here.

.github/workflows/socket-tier1-analysis.yml

@@ -0,0 +1,47 @@
+name: Socket Tier 1 Reachability Analysis
+
+on:
+  schedule:
+    # every day at 12 AM
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+    inputs:
+      tags:
+        description: 'Manually run vulnerability analysis'
+      distinct_id:
+        description: 'Required by the return-dispatch action'
+        required: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  socket-vulnerability-analysis:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - name: Check distinct_id
+        env:
+          DISTINCT_ID: ${{ github.event.inputs.distinct_id }}
+        run: |
+          echo "distinct_id: $DISTINCT_ID"
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Install Socket CLI
+        # Pinned so a compromised release can't run arbitrary code next to
+        # SOCKET_SECURITY_API_TOKEN; bump deliberately.
+        run: npm install -g socket@1.1.145
+      - name: Run Tier 1 reachability scan
+        env:
+          SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_API_KEY }}
+        run: |
+          # Full application reachability (Tier 1)
+          socket scan create . \
+            --reach \
+            --org "workos" \
+            --no-interactive

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 WorkOS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -530,3 +530,14 @@ A complete, runnable Electron app consuming this SDK lives in [`example/`](./exa
 
 - [WorkOS AuthKit docs](https://workos.com/docs/user-management)
 - [`@workos/authkit-session`](https://www.npmjs.com/package/@workos/authkit-session) — the framework-agnostic core this library builds on
+
+## Contributing
+
+Issues and pull requests are welcome. Before opening a PR:
+
+- Run `pnpm lint`, `pnpm typecheck`, and `pnpm test` — CI enforces all three.
+- Use a [conventional commit](https://www.conventionalcommits.org/) PR title (e.g. `fix: ...`, `feat: ...`); releases are cut automatically from them via release-please.
+
+## License
+
+[MIT](./LICENSE)