diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..e477679
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+version: 2
+updates:
+  # Dev dependencies (ESLint, Prettier, Vitest, etc.).
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      dev-dependencies:
+        patterns:
+          - "*"
+
+  # GitHub Actions used by the workflows (keeps the pinned SHAs current).
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..b0f7da0
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,41 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly scan to catch advisories in code that hasn't changed.
+    - cron: "27 4 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      # Required for CodeQL to upload results to code scanning.
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@84498526a009a99c875e83ef4821a8ba52de7c22 # codeql-bundle-v2.25.5
+        with:
+          languages: ${{ matrix.language }}
+          # Static assets only; no compiled languages to build.
+          build-mode: none
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@84498526a009a99c875e83ef4821a8ba52de7c22 # codeql-bundle-v2.25.5
+        with:
+          category: "/language:${{ matrix.language }}"
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..d626ec3
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,26 @@
+# Security Policy
+
+## Supported versions
+
+Only the latest released version of the extension is supported. Please
+update before reporting an issue.
+
+## Reporting a vulnerability
+
+Please **do not** open a public issue for security problems.
+
+Instead, report privately via GitHub's
+[private vulnerability reporting](https://github.com/ShiosOS/github-pr-reverse-comments/security/advisories/new)
+("Report a vulnerability" under the **Security** tab). You can expect an
+initial response within a few days.
+
+## Scope
+
+This is a client-side browser extension. It requests only the `storage`
+permission and access to `github.com` pull request pages, stores a single
+local preference (`"newest"` or `"oldest"`), and makes no network requests.
+
+Relevant reports include, for example: a way for a malicious page to run
+code in the extension's context, exfiltrate the stored preference, or abuse
+the `github.com` host permission. Please include the affected version, the
+browser, and reproduction steps.