diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..60f6a10
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,54 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes
+* Focusing on what is best for the overall community
+
+Examples of unacceptable behavior:
+
+* The use of sexualized language or imagery, and sexual attention or advances
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement Responsibilities
+
+Project maintainers are responsible for clarifying and enforcing our standards
+and will take appropriate and fair corrective action in response to any behavior
+that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the project maintainer at x@xscriptor.com.
+All complaints will be reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org),
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..c27f2b8
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,33 @@
+# Contributing
+
+Thanks for considering contributing to Xscriptor.
+
+## How to contribute
+
+### Report bugs
+
+Open an issue at https://github.com/xscriptor/obsidian/issues with:
+
+- Your Obsidian version
+- The theme version
+- Steps to reproduce
+- Screenshots if applicable
+
+### Suggest features
+
+Open an issue with the "enhancement" label describing what you would like to see
+and why it would be useful.
+
+### Submit changes
+
+1. Fork the repository.
+2. Create a branch from `labs` for development work.
+3. Make your changes.
+4. Test with Obsidian (copy `theme.css` to your vault's theme folder).
+5. Submit a pull request against the `labs` branch.
+
+## Development notes
+
+- The theme is built from `colors.md` using `scripts/build_unified.py`.
+- Run `python3 scripts/build_unified.py` to regenerate `theme.css`.
+- Keep changes reproducible: modify the palette files, not the generated CSS.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..3e15253
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,28 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this theme, please report it by
+emailing x@xscriptor.com.
+
+Do not open a public issue for security vulnerabilities.
+
+We will acknowledge your report within 48 hours and work on a fix as soon as
+possible. Once the issue is resolved, we will publish a security advisory and
+credit the reporter.
+
+## Scope
+
+This project is an Obsidian theme (CSS only). Security issues are typically
+related to:
+
+- Malicious code embedded in the theme
+- Data exfiltration through network requests
+- Social engineering via theme documentation
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 2.x     | Yes       |
+| 1.x     | No        |