diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..b4fabfe
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,34 @@
+# Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and maintainers pledge to make participation in
+this project a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment include
+demonstrating empathy and kindness, being respectful of differing opinions and
+experiences, giving and gracefully accepting constructive feedback, and focusing
+on what is best for the community.
+
+Unacceptable behavior includes harassment, trolling, insulting or derogatory
+comments, personal or political attacks, publishing others' private information
+without permission, and other conduct which could reasonably be considered
+inappropriate in a professional setting.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the project maintainer at aaron.weiskittel@maine.edu. All complaints
+will be reviewed and investigated promptly and fairly. The maintainer is
+obligated to respect the privacy and security of the reporter of any incident.
+
+## Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant, version 2.1,
+available at https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..5674716
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,19 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+If you discover a security issue (for example in deployment scripts, a web
+interface, or CI workflows), please email aaron.weiskittel@maine.edu rather than
+opening a public issue.
+
+## Scope
+
+This repository contains scientific research code, not a production service.
+Where the repository includes deployment or pipeline infrastructure that may run
+in a server context, security reports for those components are welcome.
+
+## Credentials
+
+Never commit credentials, API tokens, SSH keys, or passwords to this repository.
+Check `.gitignore` before committing, and if a secret is ever exposed, revoke and
+rotate it immediately.