diff --git a/.loupe/scanner-config.json b/.loupe/scanner-config.json
new file mode 100644
index 0000000..ffb4776
--- /dev/null
+++ b/.loupe/scanner-config.json
@@ -0,0 +1,14 @@
+{
+  "max_concurrent_files": 1,
+  "include_extensions": ["js", "mjs", "ts", "tsx"],
+  "extra_source_paths": [
+    "src",
+    "scripts/create-four-node-devnet.mjs",
+    "Dockerfile",
+    "docker-compose.yml",
+    "docker-compose.coolify.yml",
+    "docker/entrypoint.sh",
+    "docker/caddy/Caddyfile",
+    "vite.config.ts"
+  ]
+}
diff --git a/README.md b/README.md
index 68ea73d..965c3d7 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,7 @@ The backend is Node/Express. The frontend is React/Vite and follows the dark, co
 ## Planning Docs
 
 - [Genesis release automation plan](docs/genesis-release-automation-plan.md): proposed event history, configurable `go-zenon` release targets, operator-specific bootstrap scripts, and node polling automation.
+- [Loupe security scanning](docs/loupe-security-scanning.md): guarded repository registration, scanner scope, and baseline/incremental scan commands.
 
 ## Important Security Notes
 
diff --git a/docs/loupe-security-scanning.md b/docs/loupe-security-scanning.md
new file mode 100644
index 0000000..6eecb45
--- /dev/null
+++ b/docs/loupe-security-scanning.md
@@ -0,0 +1,68 @@
+# Loupe Security Scanning
+
+This repository carries a Project Loupe scanner profile at
+`.loupe/scanner-config.json`. The profile covers the TypeScript application
+and the operational files that automatic package-root discovery would not
+normally include, especially the devnet wallet-generation script, container
+definitions, Caddy configuration, and Vite configuration.
+
+## Register the repository
+
+Run these commands from a checkout of this repository after the Loupe server,
+worker, and `loupectl` client are configured:
+
+```bash
+loupectl repo add \
+  --clone-url https://github.com/0x3639/testnet.git \
+  --branch main \
+  --scanner-config-file .loupe/scanner-config.json \
+  --no-reporting \
+  --verification-enabled \
+  --require-approval
+```
+
+The safe initial policy is deliberate:
+
+- `--no-reporting` keeps findings in Loupe for manual triage until a tracker
+  repository and scoped GitHub token are selected.
+- `--verification-enabled` asks a second agent to validate each candidate.
+- `--require-approval` prevents a confirmed finding from being dispatched
+  without an operator decision.
+- No scan interval is set, so the first runs are explicitly controlled and
+  their provider usage can be observed.
+- The profile scans one file at a time for the initial baseline to keep
+  provider usage bounded. Increase concurrency only after reviewing that run.
+
+The command prints the assigned repository ID. Start the baseline scan with:
+
+```bash
+loupectl repo scan <repo-id>
+```
+
+Inspect progress and results with:
+
+```bash
+loupectl job list
+loupectl finding list <repo-id>
+loupectl finding show <finding-id>
+```
+
+After the baseline completes, scan later changes incrementally:
+
+```bash
+loupectl repo scan <repo-id> --incremental
+```
+
+## Profile lifecycle
+
+Loupe stores the scanner JSON when the repository is registered. If
+`.loupe/scanner-config.json` changes, reload it without discarding prior jobs
+or findings:
+
+```bash
+loupectl repo update <repo-id> \
+  --scanner-config-file .loupe/scanner-config.json
+```
+
+Do not put Loupe credentials, API keys, GitHub tokens, wallet material, or
+testnet operator secrets in this profile.