security: add CodeQL scanning workflow

.github/workflows/codeql.yml

@@ -0,0 +1,40 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: '17 4 * * 3'
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: javascript-typescript
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          category: '/language:javascript-typescript'

docs/contributing/security-guidelines.md

@@ -19,6 +19,16 @@ Command arguments, paths, config, environment values, template data, process out
 - test expected failure paths and security-sensitive boundaries;
 - fail closed for network/deployment target ambiguity.
 
+## Automated Code Scanning
+
+`.github/workflows/codeql.yml` runs CodeQL analysis for the JavaScript/TypeScript codebase on pull requests, pushes to `main`, and a weekly schedule.
+
+CodeQL findings are owned by the StellarForge CLI maintainers as security work, not by the automation itself. A maintainer should triage each new finding for validity, reachability, severity, and affected trust boundary before dismissal or remediation.
+
+Do not dismiss a CodeQL alert merely because CI passes or exploitation has not been demonstrated. False-positive or accepted-risk dismissals should include enough rationale to support later audit/review. Findings involving command execution, filesystem writes, secrets, deployment, dependency handling, or other documented trust boundaries require heightened review.
+
+CodeQL complements tests and human review; it does not replace either.
+
 ## Vulnerabilities
 
 Do not open a public issue for a suspected vulnerability. Follow `SECURITY.md` and GitHub Private Vulnerability Reporting.