chore: harden repository trust and security

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @AmirMotefaker

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,62 @@
+name: Bug report
+description: Report a reproducible problem
+title: "[Bug]: "
+labels: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Do not include secrets or private data.
+        Security vulnerabilities must be reported privately through the Security tab.
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened?
+      placeholder: Describe the problem clearly.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Provide the smallest reliable reproduction.
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, browser/runtime, Python/Node version, commit/release, or other relevant context.
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Sanitized logs or screenshots
+      description: Remove API keys, tokens, private URLs, email addresses, and other sensitive information before posting.
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues.
+          required: true
+        - label: This is not a security vulnerability.
+          required: true
+        - label: I removed secrets and private information.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability privately
+    url: https://github.com/AmirMotefaker/ChatGPT-Web-Application/security/advisories/new
+    about: Do not disclose security vulnerabilities in public issues.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,45 @@
+name: Feature request
+description: Suggest an improvement
+title: "[Feature]: "
+labels: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Describe the user problem first, then the proposed solution.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user or developer problem should be solved?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the desired behavior and scope.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checklist
+      options:
+        - label: I searched existing issues and requests.
+          required: true
+        - label: I have not included secrets or private data.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,24 @@
+## Summary
+
+Describe the change and why it is needed.
+
+## Validation
+
+Describe the tests/checks you ran.
+
+## Security & privacy
+
+- [ ] No secrets, credentials, private data, or sensitive logs are included.
+- [ ] Security impact was considered.
+- [ ] If this fixes a vulnerability, disclosure was coordinated privately.
+
+## Scope
+
+- [ ] The change is focused and avoids unrelated churn.
+- [ ] Documentation/tests were updated when behavior changed.
+- [ ] I did not add or change a license without an explicit maintainer decision.
+
+## Checklist
+
+- [ ] GitHub Actions checks pass.
+- [ ] I reviewed the final diff.

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "17 4 * * 1"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (python)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        with:
+          languages: python
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4

.github/workflows/python-modernization.yml

@@ -2,18 +2,24 @@ name: Python modernization validation
 
 on:
   pull_request:
+    branches:
+      - main
   push:
     branches:
       - main
-      - agent/openai-responses-modernization-2026-v1
 
 permissions:
   contents: read
 
+concurrency:
+  group: python-modernization-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate:
     name: validate (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     strategy:
       fail-fast: false
@@ -24,16 +30,20 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
 
       - name: Install dependencies
-        run: python -m pip install -r requirements.txt
+        run: |
+          python -m pip install --disable-pip-version-check -r requirements.txt
+          python -m pip check
 
       - name: Compile Python
         run: python -m compileall -q .
@@ -45,13 +55,15 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+
           if grep -R -n -E \
             --exclude-dir=.git \
             --exclude='*.ipynb' \
             'sk-[A-Za-z0-9_-]{20,}' .; then
             echo "Potential API key detected."
             exit 1
           fi
+
           modern_files=(openai_service.py)
 
           if [[ -f chat.py ]]; then

CODE_OF_CONDUCT.md

@@ -0,0 +1,25 @@
+# Code of Conduct
+
+## Our standard
+
+Participation in this repository should be respectful, professional, and focused on constructive collaboration.
+
+Examples of expected behavior include:
+
+- discussing technical disagreements without personal attacks,
+- giving actionable and specific feedback,
+- respecting privacy and confidentiality,
+- avoiding harassment, discrimination, threats, or deliberate disruption,
+- and helping keep issues and pull requests relevant to the project.
+
+## Unacceptable behavior
+
+Harassment, hateful or discriminatory content, sexualized conduct, doxxing, threats, spam, and sustained bad-faith disruption are not acceptable.
+
+## Enforcement
+
+The repository maintainer may edit, hide, lock, or remove content and may restrict participation when needed to protect contributors and the project.
+
+For sensitive conduct concerns, do not publish private details in a public issue. Use an appropriate private contact channel available through the maintainer's GitHub profile.
+
+Security vulnerabilities are handled separately through `SECURITY.md`.

CONTRIBUTING.md

@@ -0,0 +1,45 @@
+# Contributing
+
+Thanks for helping improve this repository.
+
+## Before you start
+
+- Search existing issues before opening a new one.
+- Use the issue templates for bugs and feature requests.
+- For security vulnerabilities, follow `SECURITY.md` and use private vulnerability reporting instead of a public issue.
+- Keep changes focused. Avoid unrelated formatting or generated-file churn.
+- Never commit secrets or personal/private data.
+
+## Development workflow
+
+1. Fork or create a feature branch.
+2. Make the smallest coherent change.
+3. Run the repository validation steps.
+4. Update documentation and tests when behavior changes.
+5. Open a pull request using the repository PR template.
+
+## Validation
+
+```bash
+python -m pip install -r requirements.txt
+python -m compileall -q .
+python -m unittest discover -s tests -v
+```
+
+## Pull requests
+
+A good pull request explains:
+
+- what changed,
+- why it changed,
+- how it was tested,
+- security or compatibility implications,
+- and any follow-up work.
+
+The repository uses GitHub Actions as an automated validation gate.
+
+## License note
+
+Contributing does not change the repository's existing licensing status. Do not add, replace, or reinterpret a license as part of an unrelated pull request without an explicit maintainer decision.
+
+Repository: `AmirMotefaker/ChatGPT-Web-Application`

SECURITY.md

@@ -0,0 +1,30 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes target the current `main` branch and, when applicable, the latest published release.
+
+Historical notebooks, archived examples, and explicitly legacy material are retained for learning and may contain deprecated patterns. Security fixes prioritize the supported entrypoints documented in the repository README.
+
+## Reporting a vulnerability
+
+**Please do not open a public GitHub issue for a suspected vulnerability.**
+
+Use GitHub's private vulnerability reporting flow:
+
+1. Open the repository's **Security** tab.
+2. Open **Advisories**.
+3. Choose **Report a vulnerability**.
+4. Include affected files/versions, impact, reproduction steps, and any suggested mitigation.
+
+Repository:
+
+`https://github.com/AmirMotefaker/ChatGPT-Web-Application`
+
+## What to expect
+
+Reports will be reviewed privately. Please allow reasonable time for validation, remediation, and coordinated disclosure before publishing technical details.
+
+## Secrets
+
+Never include production credentials, API keys, tokens, passwords, private datasets, or other sensitive values in issues, pull requests, screenshots, or logs.