Prepare for open source + developer.superhero.com

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security issue
+    url: https://github.com/superhero-com/superhero-developer-docs/security/advisories/new
+    about: Please report security problems privately, not as an issue.
+  - name: Bug in the Superhero app
+    url: https://github.com/superhero-com/superhero/issues
+    about: Product bugs go to the app repository.

.github/ISSUE_TEMPLATE/docs-issue.md

@@ -0,0 +1,11 @@
+---
+name: Docs issue
+about: Something in the docs is wrong, missing or unclear
+labels: docs
+---
+
+**Page:** <!-- e.g. https://developer.superhero.com/tokens/bonding-curve/ -->
+
+**What is wrong or missing:**
+
+**Source that shows the correct fact (link):**

CONTRIBUTING.md

@@ -0,0 +1,30 @@
+# Contributing
+
+Thanks for helping improve the Superhero developer docs.
+
+## Before you open a pull request
+
+1. `pnpm install` and `pnpm dev` to preview at http://localhost:3000.
+2. Run `python3 scripts/lint-mdx.py`. It must report 0 issues. MDX errors break the whole build.
+3. Every fact (an address, an endpoint, a fee, a parameter) must trace to source: the
+   `superhero-com/superhero` web app, `superhero-com/superhero-agent-skill`, or the live API at
+   `api.superhero.com`. Link the source in your pull request.
+4. New pages go in the right folder and in that folder's `_meta.json`.
+
+## Writing style
+
+- Plain, precise English. Short sentences. Second person ("you") is fine.
+- Say what something does, not how impressive it is. No marketing language.
+- No em dashes in prose; use a comma, colon or full stop.
+- Code, addresses and endpoints go in backticks.
+
+## What not to put here
+
+- Security vulnerabilities. Report them privately; see [SECURITY.md](./SECURITY.md).
+- Secrets, private keys or seed phrases, even test ones that hold funds.
+- Speculation about prices or returns.
+
+## Pull requests
+
+Keep each pull request to one topic. CI builds the site and runs the linter on every pull
+request; a maintainer reviews and merges to `main`, which deploys to developer.superhero.com.

LICENSE

@@ -1,6 +1,7 @@
 MIT License
 
-Copyright (c) 2022 Shu Ding
+Copyright (c) 2022 Shu Ding (Nextra docs template)
+Copyright (c) 2026 Superhero
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,4 +1,4 @@
-# Superhero Dev
+# Superhero developer docs
 
 The developer documentation for [Superhero](https://superhero.com), the on-chain attention
 market where you can discover, trade, and govern the trends you believe in.
@@ -23,9 +23,14 @@ pnpm build    # production build
 
 ### Deployment
 
-The canonical origin used for `og:url` and the social-card image resolves automatically:
-`NEXT_PUBLIC_SITE_URL` if set, otherwise Vercel's `VERCEL_PROJECT_PRODUCTION_URL`. Attaching a
-custom domain in Vercel is enough; no code change is needed.
+The site is a static export (`output: 'export'`) published to GitHub Pages at
+[developer.superhero.com](https://developer.superhero.com). `.github/workflows/pages.yml` builds
+and lints every pull request and deploys on every push to `main`. The custom domain is set by
+`public/CNAME`; the canonical URL for `og:url` and the social card comes from the `SITE_URL`
+repository variable, passed to the build as `NEXT_PUBLIC_SITE_URL`.
+
+Static hosting has no server redirects. A moved page keeps a small client-side redirect page
+at its old path (see `pages/identity/profile-registry.tsx`).
 
 Brand assets live in `public/` and come from the Superhero app's own `public/` directory:
 the mark, the wordmark, the favicon set and the social card.
@@ -77,9 +82,6 @@ Five things break the build, and `scripts/lint-mdx.py` catches all of them: unqu
 frontmatter, a bare `{` or `<` in prose, a `|` inside inline code inside a table row, a broken
 internal link, and a page missing from its directory's `_meta.json`. Run it before every push.
 
-`NOTES.md` holds maintainer-only material: product defects found while writing, and facts that
-have not been verified against a live system. It is not part of the site.
-
 ## Where the content comes from
 
 | Source | What it provides |
@@ -91,6 +93,11 @@ have not been verified against a live system. It is not part of the site.
 Facts in these docs should trace back to one of those. Do not write economic parameters,
 addresses or endpoints from memory.
 
+## Contributing
+
+Pull requests are welcome. Read [CONTRIBUTING.md](./CONTRIBUTING.md) first. Security issues go
+through [SECURITY.md](./SECURITY.md), not public issues.
+
 ## License
 
-MIT
+[MIT](./LICENSE)

SECURITY.md

@@ -0,0 +1,10 @@
+# Security policy
+
+Please do **not** open a public issue or pull request for a security problem in Superhero, its
+contracts, its wallet, its API or these docs.
+
+Report it privately through GitHub's **Report a vulnerability** button on the Security tab of
+the affected `superhero-com` repository. Include what you found, how to reproduce it, and the
+impact you expect. We will acknowledge the report and keep you updated until it is resolved.
+
+Only test against accounts and funds you own, and use testnet where you can.

public/CNAME

@@ -0,0 +1 @@
+developer.superhero.com