+
+## What is it?
+
+- Like [asdf](https://asdf-vm.com) (or [nvm](https://github.com/nvm-sh/nvm) or [pyenv](https://github.com/pyenv/pyenv) but for any language) it manages [dev tools](https://mise.jdx.dev/dev-tools/) like node, python, cmake, terraform, and [hundreds more](https://mise.jdx.dev/plugins.html).
+- Like [direnv](https://github.com/direnv/direnv) it manages [environment variables](https://mise.jdx.dev/environments.html) for different project directories.
+- Like [make](https://www.gnu.org/software/make/manual/make.html) it manages [tasks](https://mise.jdx.dev/tasks/) used to build and test projects.
+
+## Migrating from rtx
+
+mise will attempt to migrate most of its internal files making the transition as easy as possible. That said, it's worth reading the [migration guide](https://mise.jdx.dev/rtx.html) because there are a few things to watch out for.
+
+## 30 Second Demo
+
+The following shows using mise to install different versions
+of [node](https://nodejs.org).
+Note that calling `which node` gives us a real path to node, not a shim.
+
+[![demo](./docs/demo.gif)](./docs/demo.gif)
+
+## Quickstart
+
+Install mise (other methods [here](https://mise.jdx.dev/getting-started.html)):
+
+```sh-session
+$ curl https://mise.run | sh
+$ ~/.local/bin/mise --version
+mise 2024.4.8
+```
+
+Hook mise into your shell (pick the right one for your shell):
+
+```sh-session
+# note this assumes mise is located at ~/.local/bin/mise
+# which is what https://mise.run does by default
+echo 'eval "$(~/.local/bin/mise activate bash)"' >> ~/.bashrc
+echo 'eval "$(~/.local/bin/mise activate zsh)"' >> ~/.zshrc
+echo '~/.local/bin/mise activate fish | source' >> ~/.config/fish/config.fish
+```
+
+Install a runtime and set it as the global default:
+
+```sh-session
+$ mise use --global node@20
+$ node -v
+v20.0.0
+```
+
+## Full Documentation
+
+See [mise.jdx.dev](https://mise.jdx.dev)
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..ef0505e7c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,128 @@
+# Security Policy
+
+mise is a convenient tool to manage developer tools, however its model is also open to potential risks. The following
+are major areas of mise and the security considerations currently being made and what needs to be made in the future.
+
+Please open a ticket or send me an email if you have thoughts on how mise can be made more secure.
+
+## Core CLI Security
+
+Development of the "core CLI" is done on jdx/mise which only a single developer (me, @jdx) has access to.
+Other contributors may only submit contributions via public Pull Requests. Reducing the number
+of developers with access down to 1 minimizes the chance of keys being leaked.
+
+This does create a [bus factor](https://en.wikipedia.org/wiki/Bus_factor) problem. If I suddenly died one day
+or otherwise wasn't able to continue development at all there are some successors listed in my GitHub account
+that can take over my account if need be.
+
+The dependencies in the core CLI are a security vector. I've tried to be judicious about what dependencies make it into
+the project. I only select dependencies with broad usage across the Rust community where possible.
+I'm open to PRs or suggestions on reducing dependency count even at the cost of functionality because it will make
+mise more secure.
+
+## mise.jdx.dev
+
+mise.jdx.dev is the asset host for mise. It's used to host precompiled mise CLI binaries, and hosts a "[VERSION](https://mise.jdx.dev/VERSION)"
+which mise uses to occasionally check for a new version being released. Everything hosted there uses a single
+vendor to reduce surface area.
+
+## mise plugins
+
+Plugins are by far the biggest source of potential problems and where the most work still needs to be made.
+
+There are 3 types of plugins:
+
+- [core](https://github.com/jdx/mise/issues/236) - plugins that are hardcoded into the CLI.
+ These are official plugins for the most common languages written in Rust.
+- community - plugins in the [mise-plugins](https://github.com/mise-plugins) GitHub Org. [See below](#mise-plugins-github-org) for details.
+- external - plugins owned by other parties, these include plugins in the shorthand registry. These are no more
+ secure than installing any random tool from the internet. These receive a warning dialog when installed in mise.
+
+Just because a plugin is inside of the shorthand registry (so you can run `mise install foo@`, does not mean
+I vouch for it. I have no idea who almost anyone that builds those plugins are. If it's coming from the mise-plugins
+GitHub org, you can have more trust in it. (See the owners with `mise plugins ls-remote --urls`).
+
+Over time we should be able to move more plugins into being fully maintained by mise. I plan to add an
+`MISE_PARANOID=1` env var that, when set, will make changes to make mise behave as securely as possible
+(e.g.: only using core/mise-plugins plugins, only allowing plugins that use GPG verification of assets).
+
+## [mise-plugins](https://github.com/mise-plugins) GitHub org
+
+This is similar to