From 24ad51939e7898c3b193db1573cbd9ed97c0f1f6 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Tue, 8 Sep 2026 01:47:10 +0100
Subject: [PATCH 1/2] security: add CodeQL analysis workflow

---
 .github/workflows/codeql.yml | 40 ++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..671eb1d
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,40 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: '17 4 * * 3'
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: javascript-typescript
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          category: '/language:javascript-typescript'

From 75f962a172172825b2af9dda33b9fab5730706bd Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Tue, 8 Sep 2026 01:47:32 +0100
Subject: [PATCH 2/2] docs: define CodeQL finding ownership

---
 docs/contributing/security-guidelines.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/docs/contributing/security-guidelines.md b/docs/contributing/security-guidelines.md
index a201a59..6b9bb0d 100644
--- a/docs/contributing/security-guidelines.md
+++ b/docs/contributing/security-guidelines.md
@@ -19,6 +19,16 @@ Command arguments, paths, config, environment values, template data, process out
 - test expected failure paths and security-sensitive boundaries;
 - fail closed for network/deployment target ambiguity.
 
+## Automated Code Scanning
+
+`.github/workflows/codeql.yml` runs CodeQL analysis for the JavaScript/TypeScript codebase on pull requests, pushes to `main`, and a weekly schedule.
+
+CodeQL findings are owned by the StellarForge CLI maintainers as security work, not by the automation itself. A maintainer should triage each new finding for validity, reachability, severity, and affected trust boundary before dismissal or remediation.
+
+Do not dismiss a CodeQL alert merely because CI passes or exploitation has not been demonstrated. False-positive or accepted-risk dismissals should include enough rationale to support later audit/review. Findings involving command execution, filesystem writes, secrets, deployment, dependency handling, or other documented trust boundaries require heightened review.
+
+CodeQL complements tests and human review; it does not replace either.
+
 ## Vulnerabilities
 
 Do not open a public issue for a suspected vulnerability. Follow `SECURITY.md` and GitHub Private Vulnerability Reporting.