Add coverage support, SECURITY.md, article outline, and coverage badge

- Install @vitest/coverage-v8 with text + lcov reporters
- Add vitest.config.ts with V8 coverage configuration
- Add coverage badge to README (94% statement coverage)
- Create SECURITY.md with responsible disclosure process
- Create docs/article-outline.md for technical article draft

Author: nidu-ninja

README.md

@@ -3,6 +3,7 @@
 [![npm version](https://img.shields.io/npm/v/@rootvector/smart-retry.svg)](https://www.npmjs.com/package/@rootvector/smart-retry)
 [![npm downloads](https://img.shields.io/npm/dm/@rootvector/smart-retry.svg)](https://www.npmjs.com/package/@rootvector/smart-retry)
 [![CI](https://github.com/rootvector2/SmartRetry/actions/workflows/ci.yml/badge.svg)](https://github.com/rootvector2/SmartRetry/actions)
+[![coverage](https://img.shields.io/badge/coverage-94%25-brightgreen)](https://github.com/rootvector2/SmartRetry)
 [![License](https://img.shields.io/npm/l/@rootvector/smart-retry.svg)](LICENSE)
 
 Async functions fail. Networks drop, servers return 500s, rate limits kick in. SmartRetry wraps any async function with configurable retry logic — exponential backoff, jitter, global timeouts, and cancellation via `AbortSignal` — so you don't have to write that boilerplate again.

SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in SmartRetry, please report it responsibly.
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+### Contact
+
+Email: **dxbnaveed.k@gmail.com**
+
+Subject line: `[SECURITY] SmartRetry — <brief description>`
+
+### What to Include
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+### Disclosure Process
+
+1. Report the vulnerability via email.
+2. You will receive an acknowledgment within 48 hours.
+3. A fix will be developed and tested privately.
+4. A patch release will be published with a security advisory.
+5. Public disclosure after the fix is available.
+
+### Scope
+
+This policy covers the `@rootvector/smart-retry` npm package and its source code at [github.com/rootvector2/SmartRetry](https://github.com/rootvector2/SmartRetry).
+
+Thank you for helping keep SmartRetry secure.

docs/article-outline.md

@@ -0,0 +1,73 @@
+# Implementing a Correct Retry Mechanism in TypeScript (With Backoff, Jitter & AbortSignal)
+
+## Outline
+
+### 1. Why Naive Retry Is Dangerous
+
+- The instinct to "just retry" masks real failure modes
+- Unbounded retries amplify load on failing services
+- Silent retry loops hide bugs and delay incident detection
+
+### 2. The Thundering Herd Problem
+
+- What happens when thousands of clients retry simultaneously
+- Fixed-delay retries create synchronized spikes
+- Real-world examples: AWS outages, API rate limit cascades
+
+### 3. Why Jitter Matters
+
+- Exponential backoff alone still creates clusters
+- Full jitter vs. equal jitter vs. decorrelated jitter
+- Mathematical intuition: spreading retry attempts across time
+- Reference: AWS Architecture Blog on exponential backoff
+
+### 4. Timeout: Global vs. Per-Attempt
+
+- Per-attempt timeout: each call gets N seconds (incomplete picture)
+- Global timeout: total wall-clock budget across all attempts
+- Why global timeout is the correct default for production systems
+- Edge case: what if the last retry starts just before timeout?
+
+### 5. AbortSignal Correctness
+
+- Why cancellation is not optional in production async code
+- Common mistakes: not cleaning up listeners, ignoring abort during sleep
+- Correct pattern: wiring AbortSignal through retry loop and delay
+- Interaction between AbortSignal and global timeout
+
+### 6. Common Bugs in Retry Loops
+
+- Retrying non-retryable errors (400, 401, 403, 404)
+- Wrapping all errors in a generic "retry failed" error
+- Off-by-one: `maxRetries` vs. total attempts
+- Not clamping delay to remaining timeout budget
+- Leaking timers on abort
+
+### 7. Introducing SmartRetry
+
+- Design goals: correctness, predictability, zero dependencies
+- Default retry policy: network errors, 429, 5xx — stop on 4xx
+- Full jitter by default
+- Global timeout with proper delay clamping
+- AbortSignal support with clean teardown
+- ESM + CJS dual build, fully typed
+
+### 8. Example Usage
+
+- Basic: wrapping a fetch call
+- Advanced: custom retry predicate with structured logging
+- Cancellation: AbortController with timeout fallback
+
+### 9. Benchmarks (Future)
+
+- Retry storm simulation: SmartRetry vs. naive loops
+- Jitter distribution visualization
+- Memory and timer cleanup validation
+
+---
+
+**Target platforms:** Dev.to, Hashnode, Medium, personal blog
+
+**Estimated length:** 2,500–3,500 words
+
+**Goal:** Establish authority on retry correctness; drive organic traffic to the npm package.