docs: add FAQ/security/changelog

docs/SECURITY.md

@@ -0,0 +1,30 @@
+# Security Notes
+
+OCM is a **local web UI** for managing OpenClaw. Security depends heavily on how you run OpenClaw and how you use Telegram.
+
+## Recommended defaults
+
+- **Run locally** and restrict host binding unless you intentionally expose it.
+- Treat OpenClaw config as secrets: tokens, provider keys, account ids.
+- Prefer separate workspaces for each agent/sub-agent.
+
+## Telegram safety
+
+Strongly recommended:
+
+- **One Telegram group = one agent boundary** (context + purpose + workspace)
+- Keep each agent group **private**: only you + the bot (and optionally your second account)
+- Do **not** invite other people (cost + security risk)
+
+Critical BotFather settings:
+- Allow Groups = ON
+- Group Privacy = OFF
+
+## Sharing screenshots
+
+If you share screenshots publicly:
+- blur personal paths (e.g. `/Users/<name>/...`)
+- blur Telegram group/peer IDs (e.g. `-100xxxxxxxxxx`)
+- blur any tokens/keys if visible
+
+This repo contains **redacted + annotated** screenshots under `docs/annotated-screenshots/`.