diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 8819f487..2a91fa77 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,29 +1,10 @@
-# Default owner for everything
+# Code owners for security-critical files
* @webdevcom01-cell
-# CI/CD and GitHub config
-.github/ @webdevcom01-cell
+# Security configuration files
+/.github/SECURITY.md @webdevcom01-cell
+/.github/workflows/security-scan.yml @webdevcom01-cell
+/.env.example @webdevcom01-cell
-# Database schema — changes require careful review
-prisma/ @webdevcom01-cell
-
-# Core runtime engine
-src/lib/runtime/ @webdevcom01-cell
-
-# Security-sensitive code
-src/lib/security/ @webdevcom01-cell
-src/lib/safety/ @webdevcom01-cell
-src/lib/webhooks/verify.ts @webdevcom01-cell
-src/middleware.ts @webdevcom01-cell
-src/lib/api/auth-guard.ts @webdevcom01-cell
-
-# AI and model configuration
-src/lib/ai.ts @webdevcom01-cell
-src/lib/models.ts @webdevcom01-cell
-
-# Knowledge base / RAG pipeline
-src/lib/knowledge/ @webdevcom01-cell
-
-# ECC integration
-src/lib/ecc/ @webdevcom01-cell
-services/ecc-skills-mcp/ @webdevcom01-cell
+# Documentation
+/README.md @webdevcom01-cell
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
new file mode 100644
index 00000000..3ecd5db8
--- /dev/null
+++ b/.github/SECURITY.md
@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| ------- | --------- |
+| 1.x.x | ✅ |
+| < 1.0 | ❌ |
+
+## Reporting a Vulnerability
+
+**DO NOT** report security vulnerabilities through public GitHub issues.
+
+Instead, please use GitHub Security Advisories: click "Report a vulnerability" on the Security tab.
+
+### Response Timeline
+
+- **Acknowledgement**: Within 48 hours
+- **Initial Assessment**: Within 5 business days
+- **Fix Development**: 1-4 weeks depending on severity
+- **Public Disclosure**: After fix is deployed
+
+### Security Best Practices
+
+1. Regular security audits
+2. Automated dependency scanning
+3. All changes require review
+4. Annual penetration testing
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
new file mode 100644
index 00000000..925e2c6a
--- /dev/null
+++ b/.github/workflows/security-scan.yml
@@ -0,0 +1,34 @@
+name: Security Scan
+
+on:
+ push:
+ branches: [ main, develop ]
+ pull_request:
+ branches: [ main ]
+ schedule:
+ - cron: '0 0 * * 0'
+
+jobs:
+ security-scan:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+
+ - name: Set up Node.js
+ uses: actions/setup-node@v4
+ with:
+ node-version: '20'
+ cache: 'npm'
+
+ - name: Install dependencies
+ run: npm ci || npm install
+
+ - name: Run npm audit
+ run: npm audit --audit-level=high
+ continue-on-error: true
+
+ - name: Security Summary
+ run: echo "Security scan completed. Review audit output above."
diff --git a/README.md b/README.md
index 9d0f2b88..11eeef5c 100644
--- a/README.md
+++ b/README.md
@@ -1,328 +1,50 @@
-
-
Agent Studio
- Visual AI agent builder with multi-agent orchestration and continuous learning.
-
+# Agent Studio
-
-
- 
-
-
- 
-
-
- 
-
-
- 
-
-
- 
-
- 
-
+## Security
-
- 
- 
- 
- 
- 
- 
- 
- 
-
+### Security Policy
-
-
- 
-
-
- 
-
-
- 
-
-
+We take security seriously. Please review our [Security Policy](.github/SECURITY.md) for reporting vulnerabilities.
----
+### Security Guidelines
-## What is Agent Studio?
+1. **Authentication & Authorization**
+ - Always use parameterized queries to prevent SQL injection
+ - Implement proper authentication middleware for protected routes
+ - Use environment variables for secrets (never hardcode)
+ - Hash passwords with bcrypt (minimum 12 rounds)
-Most AI agent frameworks force you to write code to wire together models, tools, and logic. Agent Studio lets you **build, deploy, and orchestrate production-grade AI agents visually** — through a drag-and-drop flow editor — without sacrificing the depth that technical teams need.
+2. **Input Validation**
+ - Sanitize all user inputs
+ - Use DOMPurify for HTML content
+ - Validate data types and ranges
+ - Implement rate limiting
-Connect any LLM provider, ingest your knowledge base, link MCP servers, and let agents call each other. When you're ready, deploy to Railway in one click or self-host with Docker.
+3. **Dependencies**
+ - Regularly update dependencies
+ - Run `npm audit` and `npm audit fix`
+ - Monitor for security advisories
----
+4. **Code Security**
+ - Follow principle of least privilege
+ - Implement proper error handling (no sensitive data leakage)
+ - Use HTTPS in production
+ - Enable security headers
-## Quick Start
-
-**Option A — Pull published image** *(fastest)*
-
-```bash
-docker pull ghcr.io/webdevcom01-cell/agent-studio:latest
-```
-
-Then copy `.env.example` to `.env`, add your API keys, and run with `docker compose up`.
-
-**Option B — Build from source**
+### Getting Started
```bash
git clone https://github.com/webdevcom01-cell/agent-studio.git
cd agent-studio
+npm install
cp .env.example .env
-# Add DEEPSEEK_API_KEY and OPENAI_API_KEY to .env, then:
-docker compose up
-```
-
-Open [http://localhost:3000](http://localhost:3000) and create your first agent.
-
-> **No Docker?** See [Manual Setup](#manual-setup) below.
-
----
-
-## Features
-
-- **Visual Flow Editor** — Drag-and-drop builder with 55 node types (AI, logic, integrations, webhooks) powered by XyFlow; full version history, deploy pipeline, and one-click rollback
-- **Enterprise RAG Pipeline** — Ingest URLs, PDFs, DOCX, Excel, PPTX; chunk with 5 strategies; hybrid search (semantic + BM25) with pgvector; LLM re-ranking and RAGAS evaluation
-- **MCP + A2A Protocols** — Connect any MCP server (Streamable HTTP + SSE); agent-to-agent communication following Google A2A v0.3 with circuit breaker and distributed tracing
-- **Inbound Webhooks** — Standard Webhooks spec (HMAC-SHA256); receive events from GitHub, Stripe, Slack, and any provider; trigger flows with idempotency and event filtering
-- **Agent Marketplace** — 221 production-ready templates across 19 industries with faceted search, discovery, and one-click import
-- **Agent Evals** — 3-layer testing: deterministic assertions, semantic similarity, LLM-as-Judge with 12 assertion types and deploy-triggered automatic runs
-- **CLI Generator** — 6-phase AI pipeline wraps any CLI tool as a fully-typed MCP server (Python FastMCP or TypeScript MCP SDK)
-- **ECC Developer Skills** — 60+ skill modules and 25 developer agent templates with autonomous meta-orchestration and instinct-based continuous learning
-- **Embeddable Chat Widget** — Drop-in `