diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..29d362f
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,76 @@
+# Contributing to nova (Nudgebee fork)
+
+Thanks for considering a contribution. This repository is a Nudgebee-maintained
+fork of [FairwindsOps/nova](https://github.com/FairwindsOps/nova). Please read
+the [`README`](README.md) and [`NOTICE`](NOTICE) for the relationship to
+upstream and the trademark disclaimer.
+
+## Where to file what
+
+- **Bugs or features that exist upstream**: prefer
+  [FairwindsOps/nova](https://github.com/FairwindsOps/nova/issues). Fixes that
+  land upstream get pulled in here on the next sync.
+- **Bugs or features specific to this fork**: file in
+  [this repository's issues](https://github.com/nudgebee/nova/issues). Use the
+  bug / feature-request templates under `.github/ISSUE_TEMPLATE/`.
+- **Security vulnerabilities**: see [`SECURITY.md`](SECURITY.md). Do **not**
+  open a public issue for security reports.
+
+## Branch model
+
+Single-branch: `main` is the only long-lived branch. Releases are cut as
+semver-tagged commits on `main` (e.g. `v0.1.0`).
+
+- All work targets `main` through a pull request.
+- Direct pushes to `main` are not accepted.
+- A release is a `v<major>.<minor>.<patch>` git tag pushed against a commit
+  on `main`. The image-build workflow publishes the corresponding
+  `ghcr.io/nudgebee/nova:v<version>` image on tag push.
+
+## Local development
+
+Requires Go 1.26+ (matching the `go` directive in `go.mod`) and
+[`golangci-lint`](https://golangci-lint.run) v2.11.3 or later.
+
+```bash
+go build ./...
+golangci-lint run ./...
+go test ./...
+```
+
+These three commands are the same ones the CI workflow
+(`.github/workflows/ci.yaml`) runs on every pull request. A PR will not be
+merged with any of them red.
+
+## Commit style
+
+Conventional Commit style, lowercase type, optional scope:
+
+```
+<type>(<scope>): <short summary>
+```
+
+Examples from the existing history:
+
+- `fix(helm): handle nil release.Info`
+- `ci: migrate image publishing from ECR to GHCR`
+- `chore(deps): bump k8s.io/client-go from 0.35.1 to 0.36.0`
+
+Common types: `feat`, `fix`, `chore`, `refactor`, `test`, `ci`, `docs`.
+
+## Pull requests
+
+- Fill out [`.github/pull_request_template.md`](.github/pull_request_template.md).
+- Link an issue with `Fixes #<n>` when one exists.
+- Keep the PR scoped to a single concern. If reviewers ask for unrelated
+  changes, push back or split into a follow-up PR.
+- Add or update tests for behavior changes. Pure refactors do not need new
+  tests but must keep the existing suite green.
+- Dependency bumps are handled by Dependabot; manual `go.mod` edits should
+  explain *why* in the commit body.
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the
+[Apache License, Version 2.0](LICENSE). Significant fork-specific
+contributions are summarized in [`NOTICE`](NOTICE).
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..076ddb6
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,52 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please **do not** open a public GitHub issue for security vulnerabilities.
+
+Use **GitHub's private vulnerability reporting**:
+
+1. Go to the [Security tab](https://github.com/nudgebee/nova/security) of this
+   repository.
+2. Click **Report a vulnerability**.
+3. Fill in the form with details and, if possible, a minimal reproduction.
+
+If for any reason that path is unavailable, contact
+[security@nudgebee.com](mailto:security@nudgebee.com) instead. Encrypt
+sensitive details if you have a key for that address; otherwise plain text is
+acceptable for an initial contact.
+
+## What to include
+
+- Affected version (commit SHA or release tag).
+- A clear description of the issue and the impact.
+- Steps to reproduce, ideally a minimal case.
+- Suggested fix or mitigation, if any.
+
+## What to expect
+
+- Acknowledgement within **3 business days**.
+- An initial assessment (severity, scope, whether the issue is in this fork
+  or in upstream code) within **10 business days**.
+- A fix or mitigation plan, with timeline, communicated back to the reporter.
+- Public disclosure coordinated with the reporter once a fix is available.
+
+## Scope
+
+This policy covers the code in **this repository**
+(`github.com/nudgebee/nova`).
+
+For vulnerabilities in **upstream nova**
+(`github.com/FairwindsOps/nova`) that have not yet been backported here,
+report them via Fairwinds' security process. We will pick up upstream fixes
+on the next sync.
+
+For vulnerabilities in **third-party dependencies**, file with the dependency
+maintainer first; we will bump our `go.mod` to the patched version once it is
+available.
+
+## Supported versions
+
+Only the latest `v<major>.<minor>.<patch>` release tag on `main` is actively
+patched. Users on older tags should upgrade before reporting; backports are
+case-by-case.