diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..1a22506
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,13 @@
+# Code of Conduct
+
+## Our Standards
+
+Be respectful and constructive in issues, pull requests, and reviews. Disagree about code and approach, not about people.
+
+## Project Scope
+
+This is a focused, small-maintainer project. Discussion should stay on topic for `QmtPlatform`: the QMT/miniQMT A-share execution runtime, its dry-run guards, and its integration with `QuantPlatformKit` and `CnEquityStrategies`.
+
+## Reporting and Enforcement
+
+Report unacceptable behavior to `@Pigbibi`. Reports will be handled as discreetly as possible. Maintainers may remove comments, commits, or contributions that do not follow this Code of Conduct, or block contributors for repeated or serious violations.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..f742af5
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,40 @@
+# Contributing
+
+Thanks for contributing to `QmtPlatform`.
+
+## Ground Rules
+
+- Prefer small, low-risk pull requests.
+- Keep refactors separate from behavior changes.
+- Add or update tests when changing runtime behavior.
+- Do not use the scheduled `Runtime Target Lifecycle` workflow as a substitute for local verification; it runs a fixed, disabled dry-run target and is not a place to debug changes.
+- This repository is **offline dry-run only**: any change touching order submission, the dry-run/paper-admission boundary, or the `QMT_EXECUTION_MODE` / `QMT_DRY_RUN_ONLY` guards must be verified locally with the preflight script, the test suite, and a dry-run smoke script before merging. A worked example or a green CI run on a disabled target is not proof that the safety boundary still holds — check it directly.
+
+## Branching and Pull Requests
+
+- Create a topic branch for each change.
+- Open a pull request with a short summary and a concrete test plan.
+- Wait for CI to pass before merging.
+
+## Local Verification
+
+```bash
+python3 -m pip install -e '.[test]'
+python3 -m pip install --no-deps -e ../QuantPlatformKit ../CnEquityStrategies
+
+python3 -m ruff check .
+PYTHONPATH=. PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -q tests
+```
+
+For changes touching the QMT runtime guards or strategy profiles, also run the relevant dry-run preflight and smoke scripts, e.g.:
+
+```bash
+export QMT_DRY_RUN_ONLY=true
+export STRATEGY_PROFILE=cn_industry_etf_rotation
+export QMT_MARKET_HISTORY_PATH=data/fixtures/market_history.sample.csv
+
+python3 scripts/preflight_qmt_runtime.py
+python3 scripts/smoke_cn_industry_etf_rotation_dry_run_e2e.py
+```
+
+See `README.md` for the full list of supported profiles, environment variables, and the offline paper-admission flow.
diff --git a/README.md b/README.md
index ae2900b..e777b49 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,8 @@
 # QmtPlatform
 
+A-share quant platform layer for **miniQMT / QMT**, built on `QuantPlatformKit` and `CnEquityStrategies`.
+
+Current scope is **offline dry-run only**: evaluate strategy targets and preview orders without submitting to the broker. This repository is not a shadow/live runtime; any non-dry-run order request is rejected as `blocked` and is never reported as `submitted`.
 
 ## QSL architecture role
 
@@ -9,10 +12,6 @@
 - **Consumes**: CnEquityStrategies, QuantPlatformKit, QuantRuntimeSettings, market-history inputs.
 - **Must not**: own strategy research logic or publish snapshot artifacts.
 
-A-share quant platform layer for **miniQMT / QMT**, built on `QuantPlatformKit` and `CnEquityStrategies`.
-
-Current scope is **offline dry-run only**: evaluate strategy targets and preview orders without submitting to the broker. This repository is not a shadow/live runtime; any non-dry-run order request is rejected as `blocked` and is never reported as `submitted`.
-
 ## Offline paper admission (not broker paper)
 
 `--paper-admission` is a deterministic local configuration gate, not a miniQMT/QMT paper account connection. It requires all of the following:
diff --git a/README.zh-CN.md b/README.zh-CN.md
index ce6289a..cbd943d 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -1,5 +1,8 @@
 # QmtPlatform
 
+A 股量化平台层，基于 `QuantPlatformKit` 和 `CnEquityStrategies` 构建，对接 **miniQMT / QMT**。
+
+当前范围为**仅干跑**：评估策略目标并预览订单，不向券商提交实盘；任何 non-dry-run 请求均会返回 `blocked`，不会被报告为 `submitted`。
 
 ## QSL 架构角色
 
@@ -9,10 +12,6 @@
 - **消费对象**：CnEquityStrategies、QuantPlatformKit、QuantRuntimeSettings、market-history 输入。
 - **禁止事项**：承载策略研究逻辑或发布 snapshot artifacts。
 
-A 股量化平台层，基于 `QuantPlatformKit` 和 `CnEquityStrategies` 构建，对接 **miniQMT / QMT**。
-
-当前范围为**仅干跑**：评估策略目标并预览订单，不向券商提交实盘；任何 non-dry-run 请求均会返回 `blocked`，不会被报告为 `submitted`。
-
 ## 离线 paper-admission（不是券商 paper）
 
 `--paper-admission` 是确定性的本地配置门槛，不连接 miniQMT/QMT paper 账户。它必须同时满足：
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..9672115
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,18 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you find a security issue in `QmtPlatform`, please report it privately to `@Pigbibi` instead of opening a public issue. Include what you found, the affected file or endpoint, and steps to reproduce if possible.
+
+## Secret and Credential Exposure
+
+This repository must never contain real broker credentials, account identifiers, API tokens, or other secrets in source, configuration samples, test fixtures, or workflow logs. `.env.example` and the fixtures under `data/` hold placeholder values only.
+
+If you discover a committed secret or a real account identifier, report it the same way as a vulnerability (do not open a public issue describing it) so it can be rotated and removed.
+
+## Scope Notes
+
+- Current scope is **offline dry-run only**. `QmtPlatform` evaluates strategy targets and previews orders; it does not hold a live or paper broker connection, and any non-dry-run order request is rejected as `blocked`, never reported as `submitted`.
+- The offline `--paper-admission` gate (see `README.md`) is a local configuration check, not a miniQMT/QMT paper account connection — it does not call a QMT SDK/provider or read credentials.
+- Despite the dry-run-only scope, the code paths here still model order construction, strategy profile selection, and QMT/miniQMT integration points, so changes to those paths are treated as security-relevant and should be reviewed with that in mind.
+- The scheduled `Runtime Target Lifecycle` workflow runs against a disabled target with no broker runtime configured; it does not expose or require live credentials.