diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..f790db9
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "nuget"
+    directory: "/"
+    schedule: { interval: "weekly" }
+    open-pull-requests-limit: 10
+    groups:
+      nuget-dependencies: { patterns: ["*"] }
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule: { interval: "weekly" }
+    groups:
+      actions: { patterns: ["*"] }
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule: { interval: "weekly" }
+    groups:
+      npm-dependencies: { patterns: ["*"] }
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..12e0ec9
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,15 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Report security issues privately through GitHub's [private vulnerability reporting](https://github.com/TraxSharp/Trax.Core/security/advisories/new), not a public issue. We aim to acknowledge within 3 business days.
+
+Where possible, include the affected package and version, a description, reproduction steps or a proof of concept, and the impact.
+
+## Supported versions
+
+Fixes ship against the latest version published to NuGet. Older major versions are not backported.
+
+## Supply-chain posture
+
+Trax builds and publishes through a defense-in-depth pipeline: SHA-pinned actions, isolated release credentials, OIDC trusted publishing with SLSA provenance, and locked + audited dependencies (a known-vulnerability advisory fails the build). See the [Supply Chain Security](https://traxsharp.net/docs/supply-chain-security) guide.