diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..bae9da3
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,34 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 0 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  analyze:
+    name: Analyze (python)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: python
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: CodeQL
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index bbca8cf..cab0ec8 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -9,9 +9,6 @@ on:
       - '.github/workflows/osv-scanner.yml'
   pull_request:
     branches: [main]
-    paths:
-      - 'requirements.txt'
-      - 'dev-requirements.txt'
   schedule:
     # Run weekly on Monday at 00:00 UTC to catch new CVEs
     - cron: '0 0 * * 1'
diff --git a/.github/workflows/vulture.yml b/.github/workflows/vulture.yml
new file mode 100644
index 0000000..ca90e9b
--- /dev/null
+++ b/.github/workflows/vulture.yml
@@ -0,0 +1,48 @@
+name: Dead Code Detection
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  vulture:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: 'pip'
+
+      - name: Install Vulture
+        run: pip install vulture
+
+      - name: Run Vulture and generate report
+        continue-on-error: true
+        run: |
+          echo "Dead Code Detection Report" > vulture-report.txt
+          echo "Generated: $(date -u)" >> vulture-report.txt
+          echo "========================================" >> vulture-report.txt
+          echo "" >> vulture-report.txt
+          vulture cryptnox_cli --min-confidence 60 >> vulture-report.txt 2>&1 || true
+          echo "" >> vulture-report.txt
+          echo "========================================" >> vulture-report.txt
+          echo "Total findings:" >> vulture-report.txt
+          vulture cryptnox_cli --min-confidence 60 2>/dev/null | wc -l >> vulture-report.txt || echo "0" >> vulture-report.txt
+          cat vulture-report.txt
+
+      - name: Upload Vulture report
+        uses: actions/upload-artifact@v4
+        with:
+          name: vulture-dead-code-report
+          path: vulture-report.txt
+          retention-days: 30