diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..4762729
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,13 @@
+## Summary
+<!-- What does this change do, and why? -->
+
+## Testing
+<!-- How did you verify it? Commands, screenshots, manual steps. -->
+
+## Risk
+<!-- Blast radius, rollback plan, anything reviewers should watch. -->
+
+## Checklist
+- [ ] No secrets committed (`.env`, keys, service-account JSON)
+- [ ] Docs/README updated if behavior changed
+- [ ] Linked issue where relevant
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 8846fe6..43d5b8c 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -11,7 +11,7 @@ jobs:
     if: ${{ github.actor == 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2
+      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         id: meta
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..8092348
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,38 @@
+# Dependencies
+node_modules/
+.pnp/
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+env/
+
+# Build output
+dist/
+build/
+.next/
+out/
+*.tsbuildinfo
+
+# Environment & secrets (NEVER commit)
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+service-account*.json
+svc*.json
+credentials.json
+
+# Logs & caches
+*.log
+.cache/
+coverage/
+.pytest_cache/
+
+# OS / editor
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/*
+!.vscode/extensions.json
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..4acf2e0
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,23 @@
+# Code of Conduct
+
+## Our standard
+Method Communications projects are collaborative, professional spaces. Everyone who
+participates — employees, contractors, and outside contributors — is expected to be
+respectful, constructive, and inclusive.
+
+## Expected behavior
+- Be respectful and considerate in language and actions.
+- Give and accept constructive feedback gracefully.
+- Assume good intent and focus on what is best for the project and the team.
+
+## Unacceptable behavior
+- Harassment, discrimination, or personal attacks of any kind.
+- Publishing others' private information without consent.
+- Sustained disruption of discussions or reviews.
+
+## Reporting
+Report conduct concerns privately to the Method engineering lead or your People team
+contact. Reports are handled confidentially.
+
+## Scope
+This applies within all Method-Communications repositories and related project spaces.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..1493f74
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,20 @@
+# Contributing
+
+Thanks for contributing to a Method Communications project.
+
+## Branching
+- Branch off `main`: `feature/<short-name>`, `fix/<short-name>`, or `chore/<short-name>`.
+- Keep pull requests small and focused.
+
+## Pull requests
+- `main` is protected — changes land via PR with at least one review, and code-owner
+  approval where a `CODEOWNERS` file applies.
+- Fill in the summary, testing notes, and risk. Resolve all review conversations before merge.
+- CI must be green where configured.
+
+## Commit messages
+- Imperative mood, present tense: "add X", "fix Y". Reference issues where relevant (`#123`).
+
+## Security
+- Never commit secrets (`.env`, keys, service-account JSON). See `SECURITY.md`.
+- Report vulnerabilities privately per `SECURITY.md` — do not open a public issue.