diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..caa8b8f
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# Default ownership for all files in this repository
+* @eschaar
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..ee965dd
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,37 @@
+name: Bug report
+description: Report a reproducible bug
+labels: ["bug"]
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened?
+      placeholder: A clear and concise description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Exact steps to reproduce the issue.
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Python version, OS, and any relevant details.
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..072cd63
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability report
+    url: https://github.com/eschaar/vstack/security/advisories/new
+    about: Please report security issues privately via GitHub Security Advisories.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..06216a4
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,25 @@
+name: Feature request
+description: Suggest an improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem statement
+      description: What user or developer problem does this solve?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe your proposed approach.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What alternatives did you consider?
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..0b917a3
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,20 @@
+## Summary
+
+Describe what changed and why.
+
+## Related Issues
+
+Link issues, discussions, or ADRs.
+
+## Validation
+
+- [ ] Tests pass locally
+- [ ] CI checks pass
+- [ ] Docs updated (if needed)
+
+## Release Impact
+
+- [ ] `feat:` (minor)
+- [ ] `fix:` (patch)
+- [ ] `BREAKING CHANGE` (major)
+- [ ] No release impact
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 978629e..2e754d7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,12 +81,17 @@ jobs:
           git tag -a "${{ steps.semver.outputs.version }}" -m "release ${{ steps.semver.outputs.version }}"
           git push origin "${{ steps.semver.outputs.version }}"
 
+      - name: Compute release date
+        if: steps.semver.outputs.changed == 'true'
+        id: release_date
+        run: echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
+
       - name: Create GitHub release
         if: steps.semver.outputs.changed == 'true'
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.semver.outputs.version }}
-          name: ${{ steps.semver.outputs.version }}
+          name: Release v${{ steps.semver.outputs.version }} (${{ steps.release_date.outputs.date }})
           generate_release_notes: true
 
   build-artifacts:
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..4aa53d6
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,29 @@
+# Code of Conduct
+
+## Our Commitment
+
+We are committed to making participation in this project a harassment-free experience for everyone.
+
+## Expected Behavior
+
+- Be respectful and constructive.
+- Assume good intent and ask clarifying questions.
+- Accept feedback gracefully.
+- Focus on what is best for the project and community.
+
+## Unacceptable Behavior
+
+- Harassment, hate speech, or personal attacks.
+- Trolling, deliberate intimidation, or exclusionary behavior.
+- Publishing private information without consent.
+- Any conduct that is inappropriate in a professional setting.
+
+## Reporting
+
+If you experience or witness unacceptable behavior, report it by opening a private security advisory or by contacting the maintainer directly.
+
+All reports will be reviewed and handled promptly and fairly.
+
+## Enforcement
+
+Project maintainers are responsible for clarifying and enforcing this Code of Conduct and may remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned with this Code of Conduct.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..41832e1
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,52 @@
+# Contributing
+
+Thanks for your interest in contributing to vstack.
+
+## Prerequisites
+
+- Python 3.11-3.14
+- Virtual environment enabled
+
+## Setup
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+pip install -U pip
+pip install -e ".[dev]"
+```
+
+## Development Workflow
+
+1. Create a branch from `main`.
+1. Make focused, reviewable changes.
+1. Run checks locally:
+
+```bash
+make test
+```
+
+1. Open a pull request with clear context.
+
+## Commit Message Guidance
+
+This repository uses semantic commit prefixes for releases.
+
+- `feat:` for new functionality
+- `fix:` for bug fixes
+- `chore:` for maintenance
+- `docs:` for documentation only changes
+
+Use `BREAKING CHANGE` in the commit body when applicable.
+
+## Pull Request Expectations
+
+- Keep PRs small when possible.
+- Include tests for behavior changes.
+- Update docs when behavior changes.
+- Link related issues.
+
+## Security
+
+Please do not report security issues in public issues.
+Use the process in `SECURITY.md`.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..4a29fe1
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,22 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| ------- | --------- |
+| 1.x     | Yes       |
+
+## Reporting a Vulnerability
+
+Please **do not** open a public GitHub issue for security vulnerabilities.
+
+Report vulnerabilities privately via [GitHub Security Advisories](https://github.com/eschaar/vstack/security/advisories/new).
+
+Include:
+
+- Description of the vulnerability
+- Steps to reproduce
+- Impact assessment
+- Suggested fix (if any)
+
+You will receive a response within 5 business days.