diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e69de29..468e0e7 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -0,0 +1,66 @@
+# Contributing to Astronomy Shop DevSecOps Platform
+
+We are excited that you want to contribute to this DevSecOps learning platform! Please review the guidelines below to ensure a smooth contribution process.
+
+## Workflow Strategy
+
+We use a standard Pull Request (PR) workflow:
+
+1.  **Fork the Repository:** Create a personal fork of the repository on GitHub.
+2.  **Create a Feature Branch:** Always work on a descriptive feature branch.
+    ```bash
+    git checkout -b feature/your-feature-name
+    # Or for chores/docs:
+    git checkout -b chore/update-documentation
+    ```
+3.  **Implement and Validate Locally:** Ensure your changes conform to the repository standards (see below).
+4.  **Submit a Pull Request:** Target the `main` branch of the upstream repository. Explain your changes, the rationale behind your design decisions, and any testing performed.
+5.  **Pass CI Checks:** Your PR must pass all static validation, security scans, and Kind-based integration smoke tests before it can be merged.
+
+## Commit Message Guidelines
+
+We enforce the **Conventional Commits** specification. Commit messages should have the following structure:
+
+```text
+<type>(<scope>): <description>
+
+[optional body]
+```
+
+### Common Types:
+-   `feat`: A new platform feature (e.g., adding Argo CD, Prometheus dashboards)
+-   `fix`: A bug fix or pipeline correction (e.g., fixing a failing smoke test)
+-   `docs`: Documentation-only changes (e.g., updating the roadmap or ADRs)
+-   `style`: Code style changes (whitespace, formatting, etc.)
+-   `chore`: Regular maintenance, dependency updates, or internal tooling changes
+
+### Examples:
+-   `feat(gitops): bootstrap Argo CD and configure Application manifests`
+-   `fix(ci): update smoke test curl retry interval`
+-   `docs(adr): document the security scanning strategy`
+
+## Quality Gates and Local Validation
+
+To prevent broken configurations or lint errors in CI, run the following checks locally before committing:
+
+### 1. Pre-commit Hooks
+Our hooks check formatting and syntax for YAML, markdown, shell scripts, and GitHub Actions workflows. If you have `pre-commit` installed:
+```bash
+pre-commit install
+pre-commit run --all-files
+```
+
+### 2. Helm & Kubernetes Manifest Validation
+Validate that your Helm value overrides generate syntactically correct and schema-valid Kubernetes manifests:
+```bash
+make validate
+```
+This renders the chart with overrides and runs `kubectl --dry-run=client` to catch errors.
+
+### 3. Security Config Scans
+Scan your changes for security vulnerabilities and secrets:
+```bash
+make scan
+```
+This runs a local Trivy scan on the `platform/` configurations.
+Ensure no credentials, tokens, or passwords are committed. Gitleaks will scan and block commits containing suspected secrets.
diff --git a/LICENSE b/LICENSE
index e69de29..e14c262 100644
--- a/LICENSE
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 letsconfuse (s24u)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/SECURITY.md b/SECURITY.md
index e69de29..0f37e56 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -0,0 +1,35 @@
+# Security Policy
+
+Security is a primary gate in our DevOps lifecycle, not an afterthought. This document details our supported versions, vulnerability reporting process, and our automated security framework.
+
+## Supported Versions
+
+Only the latest release or branch-pinned versions of this repository receive active security maintenance and dependencies upgrades.
+
+| Version | Supported | Notes |
+|---|---|---|
+| Main Branch |   Yes   | Tracks active development and pins upstream Helm chart. |
+| Upstream Helm Chart |   Yes   | pinned in `platform/helm/versions.env` |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project (e.g., hardcoded credentials, insecure Kubernetes configurations, pipeline secrets exposure), please do **not** open a public issue. Instead, report it through the following channel:
+
+-   Email the maintainer at: [jillworknow@gmail.com](mailto:jillworknow@gmail.com)
+-   Or submit a draft security advisory directly via the GitHub Repository under **Security > Advisories**.
+
+Please include:
+1.  A detailed description of the vulnerability.
+2.  Steps to reproduce the vulnerability.
+3.  Potential impact of the vulnerability.
+
+We will acknowledge your report within 48 hours and work on a patch as quickly as possible.
+
+## Automated Security Gates
+
+This platform automatically enforces security controls on every Pull Request and commit to the `main` branch via our [security.yml](.github/workflows/security.yml) workflow:
+
+1.  **Secret Detection (Gitleaks):** Scans the git commit history to detect accidentally exposed API keys, passwords, and private tokens.
+2.  **Infrastructure-as-Code (IaC) Scan (Trivy):** Analyzes Kubernetes manifests, Helm values, and Docker configurations for insecure default setups (e.g. running containers as root, privileged permissions, lack of resource limits).
+3.  **Vulnerability Scan (Trivy Image mode):** Audits downstream third-party container images for known Common Vulnerabilities and Exposures (CVEs) and reports them.
+4.  **Supply Chain Inventory (Syft SBOM):** Generates a Software Bill of Materials (SBOM) for container configurations and publishes it as a PR build artifact.