diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..0e7439f
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,54 @@
+name: Bug report
+description: Something on itsectools.com isn't working correctly.
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. This repo hosts documentation only — the
+        application source lives in a private codebase — but issues filed
+        here are triaged the same way and tracked through to a fix.
+
+  - type: input
+    id: page
+    attributes:
+      label: Page or feature
+      description: Which page/tool was this on?
+      placeholder: e.g. /network-pulse, /dlp, /ngfw, /mitre
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What actually happened?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Go to '...'
+        2. Click '...'
+        3. See error
+    validations:
+      required: false
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Browser/OS, screenshots, test payload, or anything else relevant.
+    validations:
+      required: false
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..f5fb6d1
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: General question
+    url: https://itsectools.com/contact
+    about: For general questions not related to a bug or feature request.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..30afd93
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,17 @@
+name: Feature request
+description: Suggest an improvement or a new test/capability.
+labels: ["enhancement", "needs-triage"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+    validations:
+      required: false
diff --git a/.github/ISSUE_TEMPLATE/security_finding.yml b/.github/ISSUE_TEMPLATE/security_finding.yml
new file mode 100644
index 0000000..a61ce70
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/security_finding.yml
@@ -0,0 +1,48 @@
+name: Incorrect test result
+description: An NGFW/AET/DLP/MITRE test result looks wrong (false positive/negative).
+labels: ["security-finding", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this when a test's verdict itself seems incorrect — e.g. a
+        firewall clearly blocked something but the tool reports it as
+        vulnerable, or the reverse.
+
+  - type: dropdown
+    id: test-type
+    attributes:
+      label: Which test
+      options:
+        - NGFW / AET
+        - DLP Validator
+        - MITRE ATT&CK
+        - Network Pulse
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: combo
+    attributes:
+      label: Specific test/combo (if applicable)
+      placeholder: e.g. chunked-delayed, max-aet, nested-json-mcp
+    validations:
+      required: false
+
+  - type: textarea
+    id: expected-vs-actual
+    attributes:
+      label: What the tool reported vs. what actually happened
+      description: e.g. "Tool said Vulnerable, but my firewall log shows the request was blocked."
+    validations:
+      required: true
+
+  - type: textarea
+    id: payload
+    attributes:
+      label: Test payload / response JSON (if you have it)
+      description: Paste the raw result JSON or firewall log line if available. Redact anything sensitive first.
+      render: json
+    validations:
+      required: false