diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..899c9d3
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,60 @@
+# Dependabot configuration for automated dependency updates
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Go module dependencies
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "dependencies"
+      - "go"
+    open-pull-requests-limit: 10
+    groups:
+      # Group all minor and patch updates together
+      go-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      # CLI framework dependencies
+      cli:
+        patterns:
+          - "github.com/spf13/*"
+      # OCI-related dependencies
+      oci:
+        patterns:
+          - "oras.land/*"
+          - "github.com/opencontainers/*"
+      # Testing dependencies
+      testing:
+        patterns:
+          - "github.com/stretchr/testify"
+
+  # GitHub Actions workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    open-pull-requests-limit: 5
+    groups:
+      # Group all GitHub Actions updates together
+      github-actions:
+        patterns:
+          - "*"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..5305ce3
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,278 @@
+# Contributing to blob-cli
+
+Thank you for your interest in contributing to blob-cli! This document provides guidelines and instructions for contributing.
+
+## Table of Contents
+
+- [Code of Conduct](#code-of-conduct)
+- [Getting Started](#getting-started)
+- [Development Workflow](#development-workflow)
+- [Code Style](#code-style)
+- [Commit Guidelines](#commit-guidelines)
+- [Testing](#testing)
+- [Pull Request Process](#pull-request-process)
+- [Getting Help](#getting-help)
+
+## Code of Conduct
+
+We are committed to providing a welcoming and inclusive environment. Please be respectful and constructive in all interactions. Harassment, discrimination, or abusive behavior will not be tolerated.
+
+## Getting Started
+
+### Prerequisites
+
+- **Go 1.25+** - [Installation guide](https://go.dev/doc/install)
+- **just** - Command runner ([installation](https://github.com/casey/just#installation))
+- **golangci-lint** - Go linter ([installation](https://golangci-lint.run/welcome/install/))
+
+### Setup
+
+1. Fork the repository on GitHub
+
+2. Clone your fork:
+   ```bash
+   git clone https://github.com/YOUR_USERNAME/blob-cli.git
+   cd blob-cli
+   ```
+
+3. Add the upstream remote:
+   ```bash
+   git remote add upstream https://github.com/meigma/blob-cli.git
+   ```
+
+4. Install development tools:
+   ```bash
+   just tools
+   ```
+
+5. Verify your setup:
+   ```bash
+   just ci
+   ```
+
+## Development Workflow
+
+### Creating a Branch
+
+Create a feature branch from `master`:
+
+```bash
+git checkout master
+git pull upstream master
+git checkout -b feat/your-feature-name
+```
+
+Use descriptive branch names with prefixes like `feat/`, `fix/`, `docs/`, or `refactor/`.
+
+### Available Commands
+
+Use `just` to run common development tasks:
+
+| Command | Description |
+|---------|-------------|
+| `just` | Run default checks (fmt, vet, lint, test) |
+| `just ci` | Run full CI pipeline (includes build) |
+| `just build` | Build the binary |
+| `just test` | Run unit tests with race detection |
+| `just lint` | Run golangci-lint |
+| `just fmt` | Check formatting |
+| `just fmt-write` | Format code (modifies files) |
+| `just tools` | Install development tools |
+| `just clean` | Remove build artifacts |
+
+### Local Testing with a Registry
+
+Start a local OCI registry for manual testing:
+
+```bash
+docker run -d -p 5000:5000 --name registry registry:2
+```
+
+Then test commands against it:
+
+```bash
+./blob push localhost:5000/test:v1 ./testdata
+./blob pull localhost:5000/test:v1 ./output
+```
+
+## Code Style
+
+### Formatting
+
+Code must be formatted with `gofmt`:
+
+```bash
+just fmt        # Check formatting
+just fmt-write  # Fix formatting
+```
+
+Imports must be organized in groups:
+1. Standard library
+2. External packages
+3. Local packages (`github.com/meigma/blob-cli`)
+
+### Linting
+
+All code must pass `golangci-lint` with no errors:
+
+```bash
+just lint
+```
+
+The linter enforces:
+- **Error handling** - All errors must be explicitly handled
+- **Security** - No common security vulnerabilities (gosec)
+- **Code quality** - Various best practices via revive, gocritic, etc.
+
+### Best Practices
+
+- Keep functions focused and concise
+- Use meaningful variable and function names
+- Add godoc comments for exported functions and types
+- Handle errors explicitly; avoid ignoring them
+- Use `context.Context` for cancellation and timeouts
+
+## Commit Guidelines
+
+This project uses [Conventional Commits](https://www.conventionalcommits.org/) for automated versioning and changelog generation.
+
+### Format
+
+```
+<type>[optional scope]: <description>
+
+[optional body]
+
+[optional footer(s)]
+```
+
+### Types and Version Impact
+
+| Type | Version Bump | Example |
+|------|--------------|---------|
+| `fix:` | Patch (0.0.x) | `fix: handle nil pointer in registry client` |
+| `feat:` | Minor (0.x.0) | `feat: add zstd compression support` |
+| `feat!:` | Major (x.0.0) | `feat!: redesign command flags` |
+| `BREAKING CHANGE:` | Major (x.0.0) | Footer indicating breaking change |
+
+Other types (no version bump, but tracked in changelog):
+- `docs:` - Documentation changes
+- `chore:` - Maintenance tasks
+- `test:` - Test additions or fixes
+- `ci:` - CI/CD changes
+- `refactor:` - Code refactoring
+- `style:` - Code style changes
+- `perf:` - Performance improvements
+
+### Examples
+
+```bash
+# Bug fix
+git commit -m "fix: prevent panic when manifest is nil"
+
+# New feature
+git commit -m "feat: add --recursive flag to cp command"
+
+# Breaking change
+git commit -m "feat!: change pull command to require explicit output path"
+
+# With scope
+git commit -m "fix(cache): handle concurrent cache writes"
+
+# With body
+git commit -m "feat: add content-addressed caching
+
+Implements local filesystem caching with automatic
+deduplication across archives based on content hash."
+```
+
+## Testing
+
+### Unit Tests
+
+Run unit tests:
+
+```bash
+just test
+```
+
+Tests run with race detection and coverage enabled by default.
+
+### Writing Tests
+
+- Use [testify](https://github.com/stretchr/testify) for assertions
+- Place test files alongside source files (`foo_test.go`)
+- Use table-driven tests for multiple test cases
+- Tag integration tests with `//go:build integration`
+
+Example:
+
+```go
+func TestPushCmd_Validation(t *testing.T) {
+    tests := []struct {
+        name    string
+        args    []string
+        wantErr bool
+    }{
+        // test cases...
+    }
+
+    for _, tt := range tests {
+        t.Run(tt.name, func(t *testing.T) {
+            // test implementation
+        })
+    }
+}
+```
+
+## Pull Request Process
+
+### Before Submitting
+
+1. **Sync with upstream**:
+   ```bash
+   git fetch upstream
+   git rebase upstream/master
+   ```
+
+2. **Run all checks**:
+   ```bash
+   just ci
+   ```
+
+### Submitting a PR
+
+1. Push your branch to your fork:
+   ```bash
+   git push origin feat/your-feature-name
+   ```
+
+2. Open a Pull Request against `meigma/blob-cli:master`
+
+3. Fill out the PR template with:
+   - Summary of changes
+   - Related issues (use `Fixes #123` to auto-close)
+   - Testing performed
+
+### PR Requirements
+
+- All CI checks must pass
+- Code must be formatted and lint-free
+- Tests must pass (including any new tests for new functionality)
+- Commits must follow Conventional Commits format
+- Changes should be focused and atomic
+
+### Review Process
+
+- A maintainer will review your PR
+- Address feedback by pushing additional commits
+- Once approved, a maintainer will merge the PR
+
+## Getting Help
+
+- **Questions**: Open a [GitHub Discussion](https://github.com/meigma/blob-cli/discussions)
+- **Bugs**: Open a [GitHub Issue](https://github.com/meigma/blob-cli/issues)
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the [Apache License 2.0](LICENSE-APACHE) or [MIT License](LICENSE-MIT), at the user's option.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..0961590
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,104 @@
+# Security Policy
+
+## Reporting Security Issues
+
+If you discover a security vulnerability in blob-cli, please report it through GitHub's private vulnerability reporting feature:
+
+1. Go to the [Security tab](../../security) of this repository
+2. Click "Report a vulnerability"
+3. Provide a detailed description of the issue
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+Include as much of the following information as possible to help us understand and resolve the issue:
+
+- Type of issue (e.g., path traversal, arbitrary file write, credential exposure)
+- Full paths of source file(s) related to the issue
+- Location of the affected source code (tag/branch/commit or direct URL)
+- Step-by-step instructions to reproduce the issue
+- Proof-of-concept or exploit code (if possible)
+- Impact of the issue and how an attacker might exploit it
+
+## Supported Versions
+
+We provide security updates for the following versions:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.x     | :white_check_mark: |
+
+## Response Timeline
+
+- **Initial Response**: We aim to acknowledge receipt of your vulnerability report within 3 business days.
+- **Status Update**: We will provide a more detailed response within 10 business days, including our assessment and expected timeline for a fix.
+- **Resolution**: We strive to resolve critical vulnerabilities within 30 days of the initial report.
+
+## Disclosure Policy
+
+We follow a coordinated disclosure process:
+
+1. Security issues are handled privately until a fix is available.
+2. Once a fix is ready, we will create a security advisory and release a patched version.
+3. We will publicly disclose the vulnerability after users have had reasonable time to update.
+4. Credit will be given to the reporter (unless anonymity is preferred) in the security advisory.
+
+## Security Practices
+
+blob-cli implements the following security measures:
+
+### Artifact Signing and Verification
+
+blob-cli supports [Sigstore](https://sigstore.dev) signing and verification for archives:
+
+- **Keyless signing**: Sign archives using OIDC identity (GitHub Actions, Google, Microsoft) without managing private keys
+- **Key-based signing**: Sign with your own private keys
+- **Policy-based verification**: Require signatures from specific OIDC issuers and subjects before pulling
+- **SLSA provenance**: Verify build provenance from GitHub Actions workflows
+
+```bash
+# Sign an archive
+blob sign ghcr.io/myorg/config:v1
+
+# Verify an archive
+blob verify --policy policy.yaml ghcr.io/myorg/config:v1
+
+# Pull with policy enforcement
+blob pull --policy policy.yaml ghcr.io/myorg/config:v1
+```
+
+### Per-File Integrity
+
+- Every file in the archive has a SHA256 hash stored in the index
+- Hashes are verified automatically when reading file content
+- Tamper with a single byte and verification fails instantly
+
+### Path Traversal Protection
+
+- Archives are validated during extraction to prevent path traversal attacks
+- Paths are "jailed" to the destination directory
+
+### Code Quality
+
+- Static analysis with [gosec](https://github.com/securego/gosec) security scanner
+- Comprehensive linting with golangci-lint
+- Race detection enabled in all tests
+
+## Third-Party Dependencies
+
+For vulnerabilities in third-party dependencies used by blob-cli:
+
+- If the vulnerability affects blob-cli, please report it through our security reporting process above
+- For vulnerabilities in upstream projects, please report directly to those projects:
+  - **Go dependencies**: Use the project's security reporting mechanism or [Go vulnerability database](https://pkg.go.dev/vuln/)
+  - **OCI/Container issues**: Report to the respective CNCF project
+
+## Security-Related Configuration
+
+When using blob-cli:
+
+- Registry credentials are read from Docker's credential store (`~/.docker/config.json`)
+- Use credential helpers for enhanced security rather than storing plain credentials
+- Cached data is stored locally; ensure appropriate file permissions on cache directories
+- When pushing to registries, use authenticated connections and verify TLS certificates
+- **Enable policy verification** in production by using `--policy` flags or configuring policies in the config file
+- Private signing keys should be stored securely with appropriate file permissions