diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..62089cc
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1 @@
+* @AmirMotefaker
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..9773b88
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,62 @@
+name: Bug report
+description: Report a reproducible problem
+title: "[Bug]: "
+labels: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Do not include secrets or private data.
+        Security vulnerabilities must be reported privately through the Security tab.
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened?
+      placeholder: Describe the problem clearly.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Provide the smallest reliable reproduction.
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, browser/runtime, Python/Node version, commit/release, or other relevant context.
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Sanitized logs or screenshots
+      description: Remove API keys, tokens, private URLs, email addresses, and other sensitive information before posting.
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues.
+          required: true
+        - label: This is not a security vulnerability.
+          required: true
+        - label: I removed secrets and private information.
+          required: true
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..4f30089
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability privately
+    url: https://github.com/AmirMotefaker/ChatGPT-Web-Application/security/advisories/new
+    about: Do not disclose security vulnerabilities in public issues.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..581cc0d
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,45 @@
+name: Feature request
+description: Suggest an improvement
+title: "[Feature]: "
+labels: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Describe the user problem first, then the proposed solution.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user or developer problem should be solved?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the desired behavior and scope.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues and requests.
+          required: true
+        - label: I have not included secrets or private data.
+          required: true
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..abc109b
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,24 @@
+## Summary
+
+Describe the change and why it is needed.
+
+## Validation
+
+Describe the tests/checks you ran.
+
+## Security & privacy
+
+- [ ] No secrets, credentials, private data, or sensitive logs are included.
+- [ ] Security impact was considered.
+- [ ] If this fixes a vulnerability, disclosure was coordinated privately.
+
+## Scope
+
+- [ ] The change is focused and avoids unrelated churn.
+- [ ] Documentation/tests were updated when behavior changed.
+- [ ] I did not add or change a license without an explicit maintainer decision.
+
+## Checklist
+
+- [ ] GitHub Actions checks pass.
+- [ ] I reviewed the final diff.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..d3c3021
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..9ca077c
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,41 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "17 4 * * 1"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (python)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        with:
+          languages: python
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
diff --git a/.github/workflows/python-modernization.yml b/.github/workflows/python-modernization.yml
index 2880a0c..4b02c25 100644
--- a/.github/workflows/python-modernization.yml
+++ b/.github/workflows/python-modernization.yml
@@ -2,18 +2,24 @@ name: Python modernization validation
 
 on:
   pull_request:
+    branches:
+      - main
   push:
     branches:
       - main
-      - agent/openai-responses-modernization-2026-v1
 
 permissions:
   contents: read
 
+concurrency:
+  group: python-modernization-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate:
     name: validate (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     strategy:
       fail-fast: false
@@ -24,16 +30,20 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
 
       - name: Install dependencies
-        run: python -m pip install -r requirements.txt
+        run: |
+          python -m pip install --disable-pip-version-check -r requirements.txt
+          python -m pip check
 
       - name: Compile Python
         run: python -m compileall -q .
@@ -45,6 +55,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+
           if grep -R -n -E \
             --exclude-dir=.git \
             --exclude='*.ipynb' \
@@ -52,6 +63,7 @@ jobs:
             echo "Potential API key detected."
             exit 1
           fi
+
           modern_files=(openai_service.py)
 
           if [[ -f chat.py ]]; then
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..8d735a5
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,25 @@
+# Code of Conduct
+
+## Our standard
+
+Participation in this repository should be respectful, professional, and focused on constructive collaboration.
+
+Examples of expected behavior include:
+
+- discussing technical disagreements without personal attacks,
+- giving actionable and specific feedback,
+- respecting privacy and confidentiality,
+- avoiding harassment, discrimination, threats, or deliberate disruption,
+- and helping keep issues and pull requests relevant to the project.
+
+## Unacceptable behavior
+
+Harassment, hateful or discriminatory content, sexualized conduct, doxxing, threats, spam, and sustained bad-faith disruption are not acceptable.
+
+## Enforcement
+
+The repository maintainer may edit, hide, lock, or remove content and may restrict participation when needed to protect contributors and the project.
+
+For sensitive conduct concerns, do not publish private details in a public issue. Use an appropriate private contact channel available through the maintainer's GitHub profile.
+
+Security vulnerabilities are handled separately through `SECURITY.md`.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..b4f14de
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,45 @@
+# Contributing
+
+Thanks for helping improve this repository.
+
+## Before you start
+
+- Search existing issues before opening a new one.
+- Use the issue templates for bugs and feature requests.
+- For security vulnerabilities, follow `SECURITY.md` and use private vulnerability reporting instead of a public issue.
+- Keep changes focused. Avoid unrelated formatting or generated-file churn.
+- Never commit secrets or personal/private data.
+
+## Development workflow
+
+1. Fork or create a feature branch.
+2. Make the smallest coherent change.
+3. Run the repository validation steps.
+4. Update documentation and tests when behavior changes.
+5. Open a pull request using the repository PR template.
+
+## Validation
+
+```bash
+python -m pip install -r requirements.txt
+python -m compileall -q .
+python -m unittest discover -s tests -v
+```
+
+## Pull requests
+
+A good pull request explains:
+
+- what changed,
+- why it changed,
+- how it was tested,
+- security or compatibility implications,
+- and any follow-up work.
+
+The repository uses GitHub Actions as an automated validation gate.
+
+## License note
+
+Contributing does not change the repository's existing licensing status. Do not add, replace, or reinterpret a license as part of an unrelated pull request without an explicit maintainer decision.
+
+Repository: `AmirMotefaker/ChatGPT-Web-Application`
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..6f375bb
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,30 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes target the current `main` branch and, when applicable, the latest published release.
+
+Historical notebooks, archived examples, and explicitly legacy material are retained for learning and may contain deprecated patterns. Security fixes prioritize the supported entrypoints documented in the repository README.
+
+## Reporting a vulnerability
+
+**Please do not open a public GitHub issue for a suspected vulnerability.**
+
+Use GitHub's private vulnerability reporting flow:
+
+1. Open the repository's **Security** tab.
+2. Open **Advisories**.
+3. Choose **Report a vulnerability**.
+4. Include affected files/versions, impact, reproduction steps, and any suggested mitigation.
+
+Repository:
+
+`https://github.com/AmirMotefaker/ChatGPT-Web-Application`
+
+## What to expect
+
+Reports will be reviewed privately. Please allow reasonable time for validation, remediation, and coordinated disclosure before publishing technical details.
+
+## Secrets
+
+Never include production credentials, API keys, tokens, passwords, private datasets, or other sensitive values in issues, pull requests, screenshots, or logs.
diff --git a/evidence/phase6-trust-security-hardening.md b/evidence/phase6-trust-security-hardening.md
new file mode 100644
index 0000000..c5f31d0
--- /dev/null
+++ b/evidence/phase6-trust-security-hardening.md
@@ -0,0 +1,77 @@
+# Phase 6 - GitHub Repository Trust & Security Hardening Evidence
+
+Generated: **2026-08-13T22:52:06Z**
+
+Repository: `AmirMotefaker/ChatGPT-Web-Application`
+
+## Community health baseline
+
+- Before Phase 6: **28%**
+- Final community-health percentage is verified after merge and recorded in the GitHub Release.
+
+## Repository security settings
+
+| Control | Before | After |
+| --- | --- | --- |
+| GitHub Actions enabled | True | True |
+| Require full-SHA action pinning | False | True |
+| Default workflow permissions | `read` | `read` |
+| Actions can approve PRs | False | False |
+| Private vulnerability reporting | False | True |
+| Vulnerability alerts | False | True |
+| Dependabot security updates | True | True |
+
+## Immutable GitHub Action pins
+
+- `actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803` — v6
+- `actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1` — v6, where used
+- `actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38` — v6, where used
+- `actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02` — v4, where used
+- `github/codeql-action@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd` — v4, where used
+
+The publisher verified each SHA against the official GitHub-owned action repository before generating the branch.
+
+## Community and trust files
+
+- `SECURITY.md`
+- `CONTRIBUTING.md`
+- `CODE_OF_CONDUCT.md`
+- `.github/CODEOWNERS`
+- `.github/PULL_REQUEST_TEMPLATE.md`
+- `.github/ISSUE_TEMPLATE/bug_report.yml`
+- `.github/ISSUE_TEMPLATE/feature_request.yml`
+- `.github/ISSUE_TEMPLATE/config.yml`
+- `.github/dependabot.yml`
+
+## License integrity
+
+No license file present before or after Phase 6 generation.
+
+Phase 6 intentionally does not choose or modify a software license.
+
+## CodeQL setup compatibility
+
+- Before: `not-configured`
+- After: `not-configured; advanced workflow planned`
+
+Default setup is disabled only when needed so the repository does not run conflicting default and advanced CodeQL configurations.
+
+## Security automation
+
+- Full-SHA workflow policy enabled.
+- Read-only default `GITHUB_TOKEN`.
+- Actions cannot approve PRs.
+- Private vulnerability reporting enabled.
+- Vulnerability alerts enabled.
+- Dependabot security updates enabled.
+- Dependabot version updates configured.
+- CodeQL added only when technically appropriate for supported source code.
+- Existing repository validation workflow hardened or a repository validation workflow added.
+
+## Lifecycle
+
+- Issue: #7
+- Branch: `agent/trust-security-hardening-2026-v1`
+- Target tag: `trust-security-v2026.08.14`
+
+No secrets, private vulnerability data, security-alert contents, or private repository data are stored in this evidence.