From 9cef2b983a17e0f88f1d6cfab61bf19c5a2258b0 Mon Sep 17 00:00:00 2001
From: avicoder <avicoder@users.noreply.github.com>
Date: Wed, 28 Jan 2026 17:21:49 +0800
Subject: [PATCH] Add PR template and CODEOWNERS for security-team approval

---
 .github/CODEOWNERS               |  2 ++
 .github/PULL_REQUEST_TEMPLATE.md | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .github/PULL_REQUEST_TEMPLATE.md

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..f481221
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# Security team must approve all changes to main
+* @jup-ag/security-team
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..62bb106
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,19 @@
+## Summary
+Short summary of the change and impact.
+
+## Audit Status
+- [ ] **Required** — Audit completed and artifacts attached
+- [ ] **Not Required** — *Justification below (3–5 lines)*
+
+### If Required
+- Audit report link: <!-- link to PDF/report -->
+- Scope: <!-- commit range / modules -->
+- Key findings + fixes: <!-- bullet points -->
+
+### If Not Required (Justification)
+<!-- Why this change does not require audit: e.g., comment-only, docs, non-executable, refactor with no logic change, test-only, etc. Include risk reasoning. -->
+
+## Deployment Intent
+- [ ] No deploy
+- [ ] Deploy new program
+- [ ] **Upgrade** existing program