diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..0dbd3c2
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,27 @@
+# Code of Conduct
+
+## Our Pledge
+
+We are committed to making participation in this project a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity, level of experience, nationality, personal appearance, race, religion, or sexual identity.
+
+## Our Standards
+
+**Positive behaviour:**
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+
+**Unacceptable behaviour:**
+- Trolling, insulting or derogatory comments
+- Public or private harassment
+- Publishing others' private information without permission
+- Other conduct which could reasonably be considered inappropriate
+
+## Enforcement
+
+Instances of abusive or unacceptable behaviour may be reported by opening an issue or contacting the maintainer directly via GitHub. All complaints will be reviewed and investigated promptly.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..809cbd0
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,32 @@
+# Contributing to Brain Dump
+
+Thanks for your interest! This is primarily a personal project, but contributions are welcome.
+
+## Getting Started
+
+```bash
+git clone https://github.com/WalkmanOfWar/braindump.git
+cd braindump
+npm install
+cp .env.local.example .env.local  # fill in your credentials
+npx prisma db push
+npm run dev
+```
+
+## Making Changes
+
+1. **Fork** the repository and create a branch from `main`
+2. **Code** — follow the existing style (TypeScript strict, Tailwind, Polish UI strings)
+3. **Check** — run `npx tsc --noEmit` before pushing; zero errors required
+4. **PR** — open a pull request with a clear description of what and why
+
+## Guidelines
+
+- All user-facing text must be in **Polish**
+- No `any` types — define proper types in `types/index.ts`
+- API routes must check session via `getServerSession(authOptions)`
+- Keep components small and reusable under `components/ui/`
+
+## Reporting Bugs
+
+Open a [GitHub Issue](https://github.com/WalkmanOfWar/braindump/issues) with steps to reproduce, expected vs actual behaviour, and your browser/OS.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..c74d414
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,20 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 1.x     | ✅        |
+
+## Reporting a Vulnerability
+
+Please **do not** open a public GitHub issue for security vulnerabilities.
+
+Instead, report them privately via [GitHub Security Advisories](https://github.com/WalkmanOfWar/braindump/security/advisories/new) or by emailing the maintainer directly (visible on the GitHub profile).
+
+Include:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+
+You'll receive a response within 7 days. If the report is valid, a fix will be released as soon as possible.