diff --git a/README.md b/README.md
index 0dc876a..2677bed 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ One pipeline definition → Kubernetes, AWS Bedrock AgentCore, or Vertex AI Agen
 Engine — same governance everywhere. Works with LangGraph, LangChain, LlamaIndex,
 CrewAI, AutoGen, or raw-SDK agents. No framework lock-in.
 
-[langship.sh](https://langship.sh) · [CLI](./langship-cli/) · [Positioning](./aude.md) · Apache 2.0
+[langship.sh](https://langship.sh) · [github.com/open-gitagent/langship.sh](https://github.com/open-gitagent/langship.sh) · [CLI](./langship-cli/) · [Positioning](./aude.md) · Apache 2.0
 
 </div>
 
@@ -305,7 +305,7 @@ CLI env: `LANGSHIP_API_URL`, `LANGSHIP_TOKEN` (override `~/.langship/config.toml
 
 ## Contributing & community
 
-- **Issues & discussion** — open a GitHub issue for bugs and feature requests. Search first.
+- **Issues & discussion** — [github.com/open-gitagent/langship.sh/issues](https://github.com/open-gitagent/langship.sh/issues) for bugs and feature requests. Search first.
 - **Contributing** — [CONTRIBUTING.md](./CONTRIBUTING.md): dev setup, what to run before a PR, conventions, how to add a node executor. Contributions accepted under Apache 2.0.
 - **Code of conduct** — [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md) (Contributor Covenant). Report concerns to <khush@lyzr.ai>.
 - **Security** — **do not** file public issues for vulnerabilities. See [SECURITY.md](./SECURITY.md) — report privately to <khush@lyzr.ai>.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..954de18
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,53 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+**Do not open a public GitHub issue for security problems.**
+
+Email **<khush@lyzr.ai>** with:
+
+- a description of the issue and its impact,
+- steps to reproduce (a minimal PoC if you have one),
+- affected version / commit,
+- any suggested fix.
+
+You'll get an acknowledgement within a few business days. We'll work with you on
+a fix and a disclosure timeline; please give us reasonable time to ship a patch
+before disclosing publicly.
+
+## Scope
+
+Langship is **self-hosted** — there's no hosted service to attack. Reports we
+care most about:
+
+- **Secret handling** — anything that could expose AES-GCM-sealed credentials,
+  `FLOW_SECRET_KEY`, agent PATs, GitHub webhook secrets, or cloud creds; weak
+  sealing; secrets leaking into logs / SSE streams / API responses.
+- **Auth / access control** — bypassing intended access to agents, environments,
+  credentials, runs, or the resume/approval endpoints.
+- **Webhook receiver** — `/webhooks/github/{id}` HMAC verification bypass or
+  forged-payload dispatch.
+- **SSRF / injection** — via repo URLs, registry hosts, Build's `mode: shell`
+  command, scanner sibling-container args, or the Restate ingress URL.
+- **AWS deploy path** (`pkg/awsdeploy`) — privilege escalation via the
+  cross-account AssumeRole, the generated IAM role/policy, or the AgentCore
+  control-plane calls.
+- **Supply chain** — dependency confusion / typosquatting affecting `flow`, the
+  `web/` bundle, or `langship-cli/`.
+
+Out of scope: issues that require an already-compromised host or a malicious
+operator (the operator is fully trusted by design — they run the whole stack),
+and findings against third-party services Langship merely talks to (GitHub, AWS,
+your registry).
+
+## Hardening notes for operators
+
+- Set a strong, **persisted** `FLOW_SECRET_KEY` — losing it makes sealed
+  credentials unrecoverable; leaking it exposes them all.
+- Don't expose the API, Restate admin/ingress, BuildKit, or MinIO to the public
+  internet — put them behind your own auth / network policy. `FLOW_PUBLIC_URL`
+  only needs the webhook path reachable.
+- The agent PAT only needs `repo` read (and `write:packages` if Build pushes to
+  GHCR); scope it minimally.
+- The AWS cross-account role used by Deploy needs ECR + IAM + bedrock-agentcore
+  permissions — scope its trust policy to your Langship host's identity only.