docs: add project contact channels

CODE_OF_CONDUCT.md

@@ -20,6 +20,7 @@ data, knowingly false claims, and requests for unauthorized exploitation are not
 welcome. Maintainers may edit, hide, reject, or remove contributions that violate
 these expectations and may restrict participation when necessary.
 
-Report conduct concerns privately through the repository owner's available
-GitHub contact or security-advisory channel. Good-faith reports will be handled
-with discretion.
+Report conduct concerns privately through the repository owner's
+[LinkedIn](https://www.linkedin.com/in/mahdikarzari),
+[Telegram](https://t.me/QM4RS), or GitHub security-advisory channel. Good-faith
+reports will be handled with discretion.

README.md

@@ -266,6 +266,15 @@ See [CHANGELOG.md](CHANGELOG.md), [CONTRIBUTING.md](CONTRIBUTING.md), and
 [GitHub publishing checklist](docs/GITHUB_PUBLISHING.md) for the first public
 push, branch protection, topics, and release setup.
 
+## Contact
+
+- LinkedIn: [Mahdi Karzari](https://www.linkedin.com/in/mahdikarzari)
+- Telegram: [@QM4RS](https://t.me/QM4RS)
+
+For security-sensitive reports, start with GitHub's private vulnerability
+reporting when available. If that channel is unavailable, use one of the contact
+methods above and avoid sending secrets or sensitive proof in the first message.
+
 ## Acknowledgements
 
 FridaBox stands on years of work by the Android instrumentation and

SECURITY.md

@@ -12,6 +12,11 @@ this repository when it is available. Do not open a public issue for a flaw that
 could expose imported APKs, JavaScript agents, device data, signing material, or
 an unintended network listener.
 
+If private vulnerability reporting is unavailable, request a private reporting
+channel through [LinkedIn](https://www.linkedin.com/in/mahdikarzari) or
+[Telegram](https://t.me/QM4RS). Do not include credentials, private APKs,
+proprietary agents, or an operational exploit in the initial message.
+
 Include:
 
 - affected commit/version and Android build;