diff --git a/.github/workflows/pr-star-required.yml b/.github/workflows/pr-star-required.yml
index 53ce21220..9cafeaf90 100644
--- a/.github/workflows/pr-star-required.yml
+++ b/.github/workflows/pr-star-required.yml
@@ -24,14 +24,23 @@ jobs:
             const repoUrl = `https://github.com/${owner}/${repo}`;
 
             async function hasStarred(username) {
-              const login = username.toLowerCase();
-              const stargazers = await github.paginate(
-                github.rest.activity.listStargazersForRepo,
-                { owner, repo, per_page: 100 },
-              );
-              return stargazers.some(u => u.login.toLowerCase() === login);
+              const targetRepo = `${owner}/${repo}`.toLowerCase();
+              try {
+                for await (const { data: starredRepos } of github.paginate.iterator(
+                  github.rest.activity.listReposStarredByUser,
+                  { username, per_page: 100 }
+                )) {
+                  if (starredRepos.some(r => r.full_name.toLowerCase() === targetRepo)) {
+                    return true;
+                  }
+                }
+              } catch (e) {
+                console.error(`Error checking stars for user ${username}:`, e);
+              }
+              return false;
             }
 
+
             async function setStatus(sha, state, description) {
               await github.rest.repos.createCommitStatus({
                 owner, repo, sha, context: CONTEXT, state, description,
diff --git a/src/app/api/issues/[id]/activities/route.ts b/src/app/api/issues/[id]/activities/route.ts
new file mode 100644
index 000000000..0548e5378
--- /dev/null
+++ b/src/app/api/issues/[id]/activities/route.ts
@@ -0,0 +1,70 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getServerSession } from "next-auth";
+import { authOptions } from "@/lib/auth";
+import { supabaseAdmin } from "@/lib/supabase";
+import { resolveAppUser } from "@/lib/resolve-user";
+
+export const dynamic = "force-dynamic";
+
+type Params = {
+  params: Promise<{ id: string }>;
+};
+
+export async function POST(req: NextRequest, { params }: Params) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  const { id } = await params;
+
+  // Verify issue ownership via project
+  const { data: issue, error: issueError } = await supabaseAdmin
+    .from("devtrack_issues")
+    .select("id, devtrack_projects(user_id)")
+    .eq("id", id)
+    .single();
+
+  if (issueError || !issue) {
+    return NextResponse.json({ error: "Issue not found" }, { status: 404 });
+  }
+
+  const project = issue.devtrack_projects as any;
+  if (project.user_id !== user.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  try {
+    const { content } = await req.json();
+
+    if (!content || typeof content !== "string" || content.trim() === "") {
+      return NextResponse.json({ error: "Comment content is required" }, { status: 400 });
+    }
+
+    const { data: activity, error: insertError } = await supabaseAdmin
+      .from("devtrack_issue_activities")
+      .insert({
+        issue_id: id,
+        type: "comment",
+        content: content.trim(),
+        author_name: session.githubLogin || "User",
+      })
+      .select("*")
+      .single();
+
+    if (insertError) {
+      console.error("Failed to insert comment activity:", insertError);
+      return NextResponse.json({ error: "Database error" }, { status: 500 });
+    }
+
+    return NextResponse.json(activity, { status: 201 });
+  } catch (err) {
+    console.error("Error creating comment:", err);
+    return NextResponse.json({ error: "Invalid request payload" }, { status: 400 });
+  }
+}
diff --git a/src/app/api/issues/[id]/route.ts b/src/app/api/issues/[id]/route.ts
new file mode 100644
index 000000000..335684f8f
--- /dev/null
+++ b/src/app/api/issues/[id]/route.ts
@@ -0,0 +1,154 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getServerSession } from "next-auth";
+import { authOptions } from "@/lib/auth";
+import { supabaseAdmin } from "@/lib/supabase";
+import { resolveAppUser } from "@/lib/resolve-user";
+
+export const dynamic = "force-dynamic";
+
+type Params = {
+  params: Promise<{ id: string }>;
+};
+
+export async function GET(req: NextRequest, { params }: Params) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  const { id } = await params;
+
+  // Fetch issue and project context to verify ownership
+  const { data: issue, error: issueError } = await supabaseAdmin
+    .from("devtrack_issues")
+    .select("*, devtrack_projects(user_id, key, name)")
+    .eq("id", id)
+    .single();
+
+  if (issueError || !issue) {
+    return NextResponse.json({ error: "Issue not found" }, { status: 404 });
+  }
+
+  // Cast because of nested join type mapping
+  const project = issue.devtrack_projects as any;
+  if (project.user_id !== user.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  // Fetch activities
+  const { data: activities, error: actError } = await supabaseAdmin
+    .from("devtrack_issue_activities")
+    .select("*")
+    .eq("issue_id", id)
+    .order("created_at", { ascending: true });
+
+  if (actError) {
+    console.error("Failed to fetch issue activities:", actError);
+    return NextResponse.json({ error: "Database error" }, { status: 500 });
+  }
+
+  // Clean nested properties for client response
+  const { devtrack_projects, ...cleanIssue } = issue;
+
+  return NextResponse.json({
+    issue: cleanIssue,
+    project: {
+      id: issue.project_id,
+      name: project.name,
+      key: project.key,
+    },
+    activities: activities || [],
+  });
+}
+
+export async function PATCH(req: NextRequest, { params }: Params) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  const { id } = await params;
+
+  // Fetch existing issue to verify ownership and check status change
+  const { data: existingIssue, error: fetchError } = await supabaseAdmin
+    .from("devtrack_issues")
+    .select("*, devtrack_projects(user_id)")
+    .eq("id", id)
+    .single();
+
+  if (fetchError || !existingIssue) {
+    return NextResponse.json({ error: "Issue not found" }, { status: 404 });
+  }
+
+  const project = existingIssue.devtrack_projects as any;
+  if (project.user_id !== user.id) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  try {
+    const { title, description, status } = await req.json();
+    const updates: Record<string, any> = {};
+
+    if (title !== undefined) {
+      if (typeof title !== "string" || title.trim() === "") {
+        return NextResponse.json({ error: "Issue title cannot be empty" }, { status: 400 });
+      }
+      updates.title = title.trim();
+    }
+
+    if (description !== undefined) {
+      updates.description = (description || "").trim();
+    }
+
+    let statusChanged = false;
+    let oldStatus = existingIssue.status;
+    if (status !== undefined) {
+      const validStatuses = ["Backlog", "Todo", "In Progress", "In Review", "Done"];
+      if (!validStatuses.includes(status)) {
+        return NextResponse.json({ error: "Invalid status value" }, { status: 400 });
+      }
+      if (status !== oldStatus) {
+        updates.status = status;
+        statusChanged = true;
+      }
+    }
+
+    updates.updated_at = new Date().toISOString();
+
+    const { data: updatedIssue, error: updateError } = await supabaseAdmin
+      .from("devtrack_issues")
+      .update(updates)
+      .eq("id", id)
+      .select("*")
+      .single();
+
+    if (updateError) {
+      console.error("Failed to update issue:", updateError);
+      return NextResponse.json({ error: "Database error" }, { status: 500 });
+    }
+
+    // Insert status change activity
+    if (statusChanged) {
+      await supabaseAdmin.from("devtrack_issue_activities").insert({
+        issue_id: id,
+        type: "status_change",
+        content: `Status changed from ${oldStatus} to ${status}`,
+      });
+    }
+
+    return NextResponse.json(updatedIssue);
+  } catch (err) {
+    console.error("Error updating issue:", err);
+    return NextResponse.json({ error: "Invalid request payload" }, { status: 400 });
+  }
+}
diff --git a/src/app/api/projects/[id]/issues/route.ts b/src/app/api/projects/[id]/issues/route.ts
new file mode 100644
index 000000000..b90c8b0a0
--- /dev/null
+++ b/src/app/api/projects/[id]/issues/route.ts
@@ -0,0 +1,120 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getServerSession } from "next-auth";
+import { authOptions } from "@/lib/auth";
+import { supabaseAdmin } from "@/lib/supabase";
+import { resolveAppUser } from "@/lib/resolve-user";
+
+export const dynamic = "force-dynamic";
+
+type Params = {
+  params: Promise<{ id: string }>;
+};
+
+export async function GET(req: NextRequest, { params }: Params) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  const { id } = await params;
+
+  // Verify project ownership
+  const { data: project, error: projectError } = await supabaseAdmin
+    .from("devtrack_projects")
+    .select("id")
+    .eq("id", id)
+    .eq("user_id", user.id)
+    .single();
+
+  if (projectError || !project) {
+    return NextResponse.json({ error: "Project not found" }, { status: 404 });
+  }
+
+  // Fetch issues
+  const { data: issues, error: issuesError } = await supabaseAdmin
+    .from("devtrack_issues")
+    .select("*")
+    .eq("project_id", id)
+    .order("issue_number", { ascending: true });
+
+  if (issuesError) {
+    console.error("Failed to fetch issues:", issuesError);
+    return NextResponse.json({ error: "Database error" }, { status: 500 });
+  }
+
+  return NextResponse.json({ issues: issues || [] });
+}
+
+export async function POST(req: NextRequest, { params }: Params) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  const { id } = await params;
+
+  // Verify project ownership
+  const { data: project, error: projectError } = await supabaseAdmin
+    .from("devtrack_projects")
+    .select("id")
+    .eq("id", id)
+    .eq("user_id", user.id)
+    .single();
+
+  if (projectError || !project) {
+    return NextResponse.json({ error: "Project not found" }, { status: 404 });
+  }
+
+  try {
+    const { title, description, status } = await req.json();
+
+    if (!title || typeof title !== "string" || title.trim() === "") {
+      return NextResponse.json({ error: "Issue title is required" }, { status: 400 });
+    }
+
+    const cleanStatus = status || "Todo";
+    const validStatuses = ["Backlog", "Todo", "In Progress", "In Review", "Done"];
+    if (!validStatuses.includes(cleanStatus)) {
+      return NextResponse.json({ error: "Invalid status value" }, { status: 400 });
+    }
+
+    // Insert issue (issue_number auto-incremented by trigger)
+    const { data: issue, error: issueError } = await supabaseAdmin
+      .from("devtrack_issues")
+      .insert({
+        project_id: id,
+        title: title.trim(),
+        description: (description || "").trim(),
+        status: cleanStatus,
+      })
+      .select("*")
+      .single();
+
+    if (issueError) {
+      console.error("Failed to create issue:", issueError);
+      return NextResponse.json({ error: "Database error" }, { status: 500 });
+    }
+
+    // Create activity for creation
+    await supabaseAdmin.from("devtrack_issue_activities").insert({
+      issue_id: issue.id,
+      type: "status_change",
+      content: `Issue created and set to status: ${cleanStatus}`,
+    });
+
+    return NextResponse.json(issue, { status: 201 });
+  } catch (err) {
+    console.error("Error creating issue:", err);
+    return NextResponse.json({ error: "Invalid request payload" }, { status: 400 });
+  }
+}
diff --git a/src/app/api/projects/[id]/repos/[repoId]/route.ts b/src/app/api/projects/[id]/repos/[repoId]/route.ts
new file mode 100644
index 000000000..9feda8569
--- /dev/null
+++ b/src/app/api/projects/[id]/repos/[repoId]/route.ts
@@ -0,0 +1,51 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getServerSession } from "next-auth";
+import { authOptions } from "@/lib/auth";
+import { supabaseAdmin } from "@/lib/supabase";
+import { resolveAppUser } from "@/lib/resolve-user";
+
+export const dynamic = "force-dynamic";
+
+type Params = {
+  params: Promise<{ id: string; repoId: string }>;
+};
+
+export async function DELETE(req: NextRequest, { params }: Params) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  const { id, repoId } = await params;
+
+  // Verify project ownership
+  const { data: project, error: projectError } = await supabaseAdmin
+    .from("devtrack_projects")
+    .select("id")
+    .eq("id", id)
+    .eq("user_id", user.id)
+    .single();
+
+  if (projectError || !project) {
+    return NextResponse.json({ error: "Project not found" }, { status: 404 });
+  }
+
+  // Delete repo link
+  const { error } = await supabaseAdmin
+    .from("devtrack_repositories")
+    .delete()
+    .eq("id", repoId)
+    .eq("project_id", id);
+
+  if (error) {
+    console.error("Failed to delete repository link:", error);
+    return NextResponse.json({ error: "Database error" }, { status: 500 });
+  }
+
+  return NextResponse.json({ success: true });
+}
diff --git a/src/app/api/projects/[id]/repos/route.ts b/src/app/api/projects/[id]/repos/route.ts
new file mode 100644
index 000000000..275fb3213
--- /dev/null
+++ b/src/app/api/projects/[id]/repos/route.ts
@@ -0,0 +1,78 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getServerSession } from "next-auth";
+import { authOptions } from "@/lib/auth";
+import { supabaseAdmin } from "@/lib/supabase";
+import { resolveAppUser } from "@/lib/resolve-user";
+
+export const dynamic = "force-dynamic";
+
+type Params = {
+  params: Promise<{ id: string }>;
+};
+
+export async function POST(req: NextRequest, { params }: Params) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  const { id } = await params;
+
+  // Verify project ownership
+  const { data: project, error: projectError } = await supabaseAdmin
+    .from("devtrack_projects")
+    .select("id")
+    .eq("id", id)
+    .eq("user_id", user.id)
+    .single();
+
+  if (projectError || !project) {
+    return NextResponse.json({ error: "Project not found" }, { status: 404 });
+  }
+
+  try {
+    const { repo_url } = await req.json();
+
+    if (!repo_url || typeof repo_url !== "string" || repo_url.trim() === "") {
+      return NextResponse.json({ error: "Repository URL is required" }, { status: 400 });
+    }
+
+    let url: URL;
+    try {
+      url = new URL(repo_url.trim());
+    } catch {
+      return NextResponse.json({ error: "Invalid URL format" }, { status: 400 });
+    }
+
+    if (!["github.com", "gitlab.com"].includes(url.hostname.replace("www.", ""))) {
+      return NextResponse.json({ error: "Only GitHub and GitLab repositories are supported" }, { status: 400 });
+    }
+
+    const { data, error } = await supabaseAdmin
+      .from("devtrack_repositories")
+      .insert({
+        project_id: id,
+        repo_url: repo_url.trim(),
+      })
+      .select("*")
+      .single();
+
+    if (error) {
+      if (error.code === "23505") { // Unique violation
+        return NextResponse.json({ error: "This repository is already linked to this project." }, { status: 409 });
+      }
+      console.error("Failed to link repository:", error);
+      return NextResponse.json({ error: "Database error" }, { status: 500 });
+    }
+
+    return NextResponse.json(data, { status: 201 });
+  } catch (err) {
+    console.error("Error linking repository:", err);
+    return NextResponse.json({ error: "Invalid request payload" }, { status: 400 });
+  }
+}
diff --git a/src/app/api/projects/[id]/route.ts b/src/app/api/projects/[id]/route.ts
new file mode 100644
index 000000000..6c00554d6
--- /dev/null
+++ b/src/app/api/projects/[id]/route.ts
@@ -0,0 +1,134 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getServerSession } from "next-auth";
+import { authOptions } from "@/lib/auth";
+import { supabaseAdmin } from "@/lib/supabase";
+import { resolveAppUser } from "@/lib/resolve-user";
+
+export const dynamic = "force-dynamic";
+
+type Params = {
+  params: Promise<{ id: string }>;
+};
+
+export async function GET(req: NextRequest, { params }: Params) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  const { id } = await params;
+
+  // Fetch project
+  const { data: project, error: projectError } = await supabaseAdmin
+    .from("devtrack_projects")
+    .select("*")
+    .eq("id", id)
+    .eq("user_id", user.id)
+    .single();
+
+  if (projectError || !project) {
+    return NextResponse.json({ error: "Project not found" }, { status: 404 });
+  }
+
+  // Fetch linked repositories
+  const { data: repositories, error: reposError } = await supabaseAdmin
+    .from("devtrack_repositories")
+    .select("*")
+    .eq("project_id", id);
+
+  if (reposError) {
+    console.error("Failed to fetch project repositories:", reposError);
+    return NextResponse.json({ error: "Database error" }, { status: 500 });
+  }
+
+  return NextResponse.json({
+    project,
+    repositories: repositories || [],
+  });
+}
+
+export async function DELETE(req: NextRequest, { params }: Params) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  const { id } = await params;
+
+  const { error } = await supabaseAdmin
+    .from("devtrack_projects")
+    .delete()
+    .eq("id", id)
+    .eq("user_id", user.id);
+
+  if (error) {
+    console.error("Failed to delete project:", error);
+    return NextResponse.json({ error: "Database error" }, { status: 500 });
+  }
+
+  return NextResponse.json({ success: true });
+}
+
+export async function PATCH(req: NextRequest, { params }: Params) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  const { id } = await params;
+
+  try {
+    const { name, description, enable_keyword_triggers } = await req.json();
+    const updates: Record<string, any> = {};
+
+    if (name !== undefined) {
+      if (typeof name !== "string" || name.trim() === "") {
+        return NextResponse.json({ error: "Project name cannot be empty" }, { status: 400 });
+      }
+      updates.name = name.trim();
+    }
+
+    if (description !== undefined) {
+      updates.description = (description || "").trim();
+    }
+
+    if (enable_keyword_triggers !== undefined) {
+      updates.enable_keyword_triggers = Boolean(enable_keyword_triggers);
+    }
+
+    updates.updated_at = new Date().toISOString();
+
+    const { data, error } = await supabaseAdmin
+      .from("devtrack_projects")
+      .update(updates)
+      .eq("id", id)
+      .eq("user_id", user.id)
+      .select("*")
+      .single();
+
+    if (error) {
+      console.error("Failed to update project:", error);
+      return NextResponse.json({ error: "Database error" }, { status: 500 });
+    }
+
+    return NextResponse.json(data);
+  } catch (err) {
+    console.error("Error updating project:", err);
+    return NextResponse.json({ error: "Invalid request payload" }, { status: 400 });
+  }
+}
diff --git a/src/app/api/projects/route.ts b/src/app/api/projects/route.ts
new file mode 100644
index 000000000..b3147eded
--- /dev/null
+++ b/src/app/api/projects/route.ts
@@ -0,0 +1,94 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getServerSession } from "next-auth";
+import { authOptions } from "@/lib/auth";
+import { supabaseAdmin } from "@/lib/supabase";
+import { resolveAppUser } from "@/lib/resolve-user";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(req: NextRequest) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  const { data, error } = await supabaseAdmin
+    .from("devtrack_projects")
+    .select("*")
+    .eq("user_id", user.id)
+    .order("created_at", { ascending: false });
+
+  if (error) {
+    console.error("Failed to fetch projects:", error);
+    return NextResponse.json({ error: "Database error" }, { status: 500 });
+  }
+
+  return NextResponse.json({ projects: data || [] });
+}
+
+export async function POST(req: NextRequest) {
+  const session = await getServerSession(authOptions);
+  if (!session?.githubId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const user = await resolveAppUser(session.githubId, session.githubLogin);
+  if (!user) {
+    return NextResponse.json({ error: "User not found" }, { status: 404 });
+  }
+
+  try {
+    const { name, key, description, enable_keyword_triggers } = await req.json();
+
+    if (!name || typeof name !== "string" || name.trim() === "") {
+      return NextResponse.json({ error: "Project name is required" }, { status: 400 });
+    }
+
+    if (!key || typeof key !== "string") {
+      return NextResponse.json({ error: "Project key is required" }, { status: 400 });
+    }
+
+    const cleanKey = key.trim().toUpperCase();
+    const keyRegex = /^[A-Z][A-Z0-9]{1,9}$/;
+    if (!keyRegex.test(cleanKey)) {
+      return NextResponse.json(
+        { error: "Project key must be 2-10 alphanumeric characters starting with a letter" },
+        { status: 400 }
+      );
+    }
+
+    // Insert project
+    const { data, error } = await supabaseAdmin
+      .from("devtrack_projects")
+      .insert({
+        user_id: user.id,
+        name: name.trim(),
+        key: cleanKey,
+        description: (description || "").trim(),
+        enable_keyword_triggers: enable_keyword_triggers !== false,
+      })
+      .select("*")
+      .single();
+
+    if (error) {
+      if (error.code === "23505") { // Unique violation
+        return NextResponse.json(
+          { error: "A project with this key already exists." },
+          { status: 409 }
+        );
+      }
+      console.error("Failed to create project:", error);
+      return NextResponse.json({ error: "Database error" }, { status: 500 });
+    }
+
+    return NextResponse.json(data, { status: 201 });
+  } catch (err) {
+    console.error("Error creating project:", err);
+    return NextResponse.json({ error: "Invalid request payload" }, { status: 400 });
+  }
+}
diff --git a/src/app/api/webhooks/github/route.ts b/src/app/api/webhooks/github/route.ts
index a64c83aa1..d84ed0468 100644
--- a/src/app/api/webhooks/github/route.ts
+++ b/src/app/api/webhooks/github/route.ts
@@ -6,6 +6,7 @@ import { verifyGitHubSignature } from "@/lib/crypto";
 import { logError } from "@/lib/error-handler";
 import { sendSSEEvent } from "@/lib/sse";
 import { invalidateUserMetricsCache } from "@/lib/metrics-cache";
+import { processCommits } from "@/lib/git-commit-linking";
 
 export const dynamic = "force-dynamic";
 
@@ -18,12 +19,22 @@ const recentDeliveries = new Map<string, number>();
 
 interface GitHubPushPayload {
   after?: string;
-  commits?: Array<unknown>;
+  commits?: Array<{
+    id: string;
+    message: string;
+    url: string;
+    author: {
+      name: string;
+      email: string;
+      username?: string;
+    };
+  }>;
   pusher?: {
     name?: string;
   };
   repository?: {
     full_name?: string;
+    html_url?: string;
   };
   sender?: {
     login?: string;
@@ -133,6 +144,17 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ received: true }, { status: 200 });
   }
 
+  // Process commit linking to DevTrack issues
+  const repoUrl = payload.repository?.html_url;
+  const commits = payload.commits;
+  if (repoUrl && commits && Array.isArray(commits)) {
+    try {
+      await processCommits(repoUrl, commits);
+    } catch (e) {
+      console.error("Error processing commits for GitHub webhook:", e);
+    }
+  }
+
   let staleResult: Awaited<ReturnType<typeof markUserMetricsStale>>;
   try {
     staleResult = await markUserMetricsStale(githubLogin);
diff --git a/src/app/api/webhooks/gitlab/route.ts b/src/app/api/webhooks/gitlab/route.ts
new file mode 100644
index 000000000..2d4070e1e
--- /dev/null
+++ b/src/app/api/webhooks/gitlab/route.ts
@@ -0,0 +1,62 @@
+import { NextRequest, NextResponse } from "next/server";
+import { processCommits } from "@/lib/git-commit-linking";
+
+export const dynamic = "force-dynamic";
+
+interface GitLabPushPayload {
+  object_kind?: string;
+  after?: string;
+  project?: {
+    name?: string;
+    web_url?: string;
+  };
+  commits?: Array<{
+    id: string;
+    message: string;
+    url: string;
+    author: {
+      name: string;
+      email: string;
+    };
+  }>;
+}
+
+export async function POST(req: NextRequest) {
+  const secret = process.env.GITLAB_WEBHOOK_SECRET || process.env.GITHUB_WEBHOOK_SECRET;
+  const token = req.headers.get("x-gitlab-token");
+
+  if (secret && token !== secret) {
+    return NextResponse.json({ error: "Invalid token" }, { status: 401 });
+  }
+
+  let payload: GitLabPushPayload;
+  try {
+    const body = await req.text();
+    payload = JSON.parse(body) as GitLabPushPayload;
+  } catch (e) {
+    return NextResponse.json({ error: "Invalid JSON payload" }, { status: 400 });
+  }
+
+  // Only handle push events
+  const objectKind = payload.object_kind || "push";
+  if (objectKind !== "push") {
+    return NextResponse.json({ received: true });
+  }
+
+  const repoUrl = payload.project?.web_url;
+  const commits = payload.commits;
+
+  if (repoUrl && commits && Array.isArray(commits)) {
+    try {
+      await processCommits(repoUrl, commits);
+    } catch (e) {
+      console.error("Error processing commits for GitLab webhook:", e);
+      return NextResponse.json(
+        { error: "Failed to process commits" },
+        { status: 500 }
+      );
+    }
+  }
+
+  return NextResponse.json({ received: true });
+}
diff --git a/src/app/dashboard/settings/page.tsx b/src/app/dashboard/settings/page.tsx
index 6015f0138..d340b4016 100644
--- a/src/app/dashboard/settings/page.tsx
+++ b/src/app/dashboard/settings/page.tsx
@@ -18,6 +18,7 @@ import { Button } from "@/components/ui/button";
 import { useLocale, useTranslations } from "next-intl";
 import { localeMetadata, locales, type AppLocale } from "@/i18n/config";
 import Image from "next/image";
+import { FolderGit, Plus, Trash2, Link2, Unlink, Settings2, HelpCircle } from "lucide-react";
 
 // ── Max length for the profile bio ──────────────────────────────────────────
 const BIO_MAX = 160;
@@ -204,6 +205,21 @@ function SettingsPageContent() {
   const [orgAccounts, setOrgAccounts] = useState<any[]>([]);
   const [orgsConfig, setOrgsConfig] = useState<Record<string, boolean>>({});
   const [loadingOrgs, setLoadingOrgs] = useState(true);
+
+  // DevTrack Projects States
+  const [projects, setProjects] = useState<any[]>([]);
+  const [loadingProjects, setLoadingProjects] = useState(true);
+  const [creatingProject, setCreatingProject] = useState(false);
+  const [newProjectName, setNewProjectName] = useState("");
+  const [newProjectKey, setNewProjectKey] = useState("");
+  const [newProjectDesc, setNewProjectDesc] = useState("");
+  const [newProjectTriggers, setNewProjectTriggers] = useState(true);
+  const [selectedProject, setSelectedProject] = useState<any | null>(null);
+  const [newRepoUrl, setNewRepoUrl] = useState("");
+  const [submittingProject, setSubmittingProject] = useState(false);
+  const [submittingRepo, setSubmittingRepo] = useState(false);
+  const [deletingProjectId, setDeletingProjectId] = useState<string | null>(null);
+  const [unlinkingRepoId, setUnlinkingRepoId] = useState<string | null>(null);
   const [isDirty, setIsDirty] = useState(false);
   const [publicWidgets, setPublicWidgets] = useState<string[]>(["streak", "contributions"]);
   const [savingWidgets, setSavingWidgets] = useState(false);
@@ -406,6 +422,220 @@ function SettingsPageContent() {
     }
   };
 
+  // Load projects on mount
+  useEffect(() => {
+    if (status !== "authenticated") return;
+    async function loadProjects() {
+      try {
+        setLoadingProjects(true);
+        const res = await fetch("/api/projects");
+        if (res.ok) {
+          const data = await res.json();
+          setProjects(data.projects || []);
+        }
+      } catch (err) {
+        console.error("Failed to load projects:", err);
+      } finally {
+        setLoadingProjects(false);
+      }
+    }
+    loadProjects();
+  }, [status]);
+
+  const handleSelectProject = async (proj: any) => {
+    if (selectedProject?.id === proj.id) {
+      setSelectedProject(null);
+      return;
+    }
+    
+    try {
+      const res = await fetch(`/api/projects/${proj.id}`);
+      if (res.ok) {
+        const data = await res.json();
+        setSelectedProject({
+          ...proj,
+          repositories: data.repositories || []
+        });
+      } else {
+        setSelectedProject({
+          ...proj,
+          repositories: []
+        });
+      }
+    } catch (err) {
+      console.error("Failed to load project details:", err);
+      setSelectedProject({
+        ...proj,
+        repositories: []
+      });
+    }
+  };
+
+  const handleCreateProject = async (e: React.FormEvent) => {
+    e.preventDefault();
+    if (!newProjectName.trim() || !newProjectKey.trim()) {
+      toast.error("Project name and key are required.");
+      return;
+    }
+
+    setSubmittingProject(true);
+    try {
+      const res = await fetch("/api/projects", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          name: newProjectName.trim(),
+          key: newProjectKey.trim(),
+          description: newProjectDesc.trim(),
+          enable_keyword_triggers: newProjectTriggers,
+        }),
+      });
+
+      const data = await res.json();
+      if (res.ok) {
+        setProjects((prev) => [data, ...prev]);
+        setNewProjectName("");
+        setNewProjectKey("");
+        setNewProjectDesc("");
+        setNewProjectTriggers(true);
+        setCreatingProject(false);
+        toast.success("Project created successfully!");
+      } else {
+        toast.error(data.error || "Failed to create project.");
+      }
+    } catch (err) {
+      console.error("Error creating project:", err);
+      toast.error("Failed to create project.");
+    } finally {
+      setSubmittingProject(false);
+    }
+  };
+
+  const handleDeleteProject = async (projId: string) => {
+    if (!window.confirm("Are you sure you want to delete this project? This will also remove all repository associations and issue tracking data.")) {
+      return;
+    }
+
+    setDeletingProjectId(projId);
+    try {
+      const res = await fetch(`/api/projects/${projId}`, {
+        method: "DELETE",
+      });
+
+      if (res.ok) {
+        setProjects((prev) => prev.filter((p) => p.id !== projId));
+        if (selectedProject?.id === projId) {
+          setSelectedProject(null);
+        }
+        toast.success("Project deleted successfully.");
+      } else {
+        const data = await res.json();
+        toast.error(data.error || "Failed to delete project.");
+      }
+    } catch (err) {
+      console.error("Error deleting project:", err);
+      toast.error("Failed to delete project.");
+    } finally {
+      setDeletingProjectId(null);
+    }
+  };
+
+  const handleToggleProjectTriggers = async (projId: string, enabled: boolean) => {
+    try {
+      const res = await fetch(`/api/projects/${projId}`, {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ enable_keyword_triggers: enabled }),
+      });
+
+      if (res.ok) {
+        const updated = await res.json();
+        setProjects((prev) => prev.map((p) => (p.id === projId ? updated : p)));
+        if (selectedProject?.id === projId) {
+          setSelectedProject((prev: any) => prev ? { ...prev, enable_keyword_triggers: updated.enable_keyword_triggers } : null);
+        }
+        toast.success("Project triggers updated.");
+      } else {
+        const data = await res.json();
+        toast.error(data.error || "Failed to update project triggers.");
+      }
+    } catch (err) {
+      console.error("Error toggling project triggers:", err);
+      toast.error("Failed to update project triggers.");
+    }
+  };
+
+  const handleLinkRepo = async (e: React.FormEvent) => {
+    e.preventDefault();
+    if (!selectedProject) return;
+    if (!newRepoUrl.trim()) {
+      toast.error("Repository URL is required.");
+      return;
+    }
+
+    setSubmittingRepo(true);
+    try {
+      const res = await fetch(`/api/projects/${selectedProject.id}/repos`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ repo_url: newRepoUrl.trim() }),
+      });
+
+      const data = await res.json();
+      if (res.ok) {
+        setSelectedProject((prev: any) => {
+          if (!prev) return null;
+          return {
+            ...prev,
+            repositories: [...(prev.repositories || []), data],
+          };
+        });
+        setNewRepoUrl("");
+        toast.success("Repository linked successfully!");
+      } else {
+        toast.error(data.error || "Failed to link repository.");
+      }
+    } catch (err) {
+      console.error("Error linking repository:", err);
+      toast.error("Failed to link repository.");
+    } finally {
+      setSubmittingRepo(false);
+    }
+  };
+
+  const handleUnlinkRepo = async (repoId: string) => {
+    if (!selectedProject) return;
+    if (!window.confirm("Are you sure you want to unlink this repository? New commits to it will no longer update this project's issues.")) {
+      return;
+    }
+
+    setUnlinkingRepoId(repoId);
+    try {
+      const res = await fetch(`/api/projects/${selectedProject.id}/repos/${repoId}`, {
+        method: "DELETE",
+      });
+
+      if (res.ok) {
+        setSelectedProject((prev: any) => {
+          if (!prev) return null;
+          return {
+            ...prev,
+            repositories: (prev.repositories || []).filter((r: any) => r.id !== repoId),
+          };
+        });
+        toast.success("Repository unlinked successfully.");
+      } else {
+        const data = await res.json();
+        toast.error(data.error || "Failed to unlink repository.");
+      }
+    } catch (err) {
+      console.error("Error unlinking repository:", err);
+      toast.error("Failed to unlink repository.");
+    } finally {
+      setUnlinkingRepoId(null);
+    }
+  };
+
   // Load active repos for spotlight pinning
   useEffect(() => {
     if (status !== "authenticated") return;
@@ -1568,6 +1798,281 @@ function SettingsPageContent() {
           </div>
         </div>
 
+        {/* DevTrack Projects Section */}
+        <div className="mt-6 rounded-xl border border-[var(--border)] bg-[var(--card)] p-6 shadow-sm">
+          <div className="flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between mb-6">
+            <div>
+              <h2 className="text-xl font-semibold text-[var(--card-foreground)] flex items-center gap-2">
+                <FolderGit className="h-5 w-5 text-[var(--accent)]" />
+                DevTrack Projects
+              </h2>
+              <p className="mt-1 text-sm text-[var(--muted-foreground)]">
+                Link Git repositories (GitHub/GitLab) to automatically map commits to issues.
+              </p>
+            </div>
+            
+            <button
+              type="button"
+              onClick={() => setCreatingProject(!creatingProject)}
+              className="inline-flex items-center justify-center gap-2 rounded-lg bg-[var(--accent)] px-4 py-2 text-sm font-medium text-[var(--accent-foreground)] hover:opacity-90 transition-opacity"
+            >
+              <Plus className="h-4 w-4" />
+              New Project
+            </button>
+          </div>
+
+          {creatingProject && (
+            <form onSubmit={handleCreateProject} className="mb-6 p-4 rounded-lg border border-[var(--border)] bg-[var(--control)]/40 space-y-4 animate-fade-in-up">
+              <h3 className="text-sm font-semibold text-[var(--card-foreground)]">Create New Project</h3>
+              <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
+                <div>
+                  <label htmlFor="proj-name" className="block text-xs font-semibold text-[var(--muted-foreground)] uppercase mb-1">
+                    Project Name
+                  </label>
+                  <input
+                    type="text"
+                    id="proj-name"
+                    value={newProjectName}
+                    onChange={(e) => setNewProjectName(e.target.value)}
+                    placeholder="e.g. My Cool App"
+                    required
+                    className="w-full rounded-lg border border-[var(--border)] bg-[var(--control)] px-3 py-2 text-sm text-[var(--card-foreground)] focus:border-[var(--accent)] outline-none"
+                  />
+                </div>
+                <div>
+                  <label htmlFor="proj-key" className="block text-xs font-semibold text-[var(--muted-foreground)] uppercase mb-1 flex items-center gap-1">
+                    Project Key
+                    <span className="text-[10px] text-[var(--muted-foreground)] lowercase">(2-10 chars, letters/numbers)</span>
+                  </label>
+                  <input
+                    type="text"
+                    id="proj-key"
+                    value={newProjectKey}
+                    onChange={(e) => setNewProjectKey(e.target.value.toUpperCase())}
+                    placeholder="e.g. PROJ"
+                    required
+                    className="w-full rounded-lg border border-[var(--border)] bg-[var(--control)] px-3 py-2 text-sm text-[var(--card-foreground)] focus:border-[var(--accent)] outline-none font-mono"
+                  />
+                </div>
+              </div>
+              <div>
+                <label htmlFor="proj-desc" className="block text-xs font-semibold text-[var(--muted-foreground)] uppercase mb-1">
+                  Description
+                </label>
+                <textarea
+                  id="proj-desc"
+                  value={newProjectDesc}
+                  onChange={(e) => setNewProjectDesc(e.target.value)}
+                  placeholder="Optional description of the project"
+                  rows={2}
+                  className="w-full rounded-lg border border-[var(--border)] bg-[var(--control)] px-3 py-2 text-sm text-[var(--card-foreground)] focus:border-[var(--accent)] outline-none resize-y"
+                />
+              </div>
+              <label className="flex items-start gap-3 cursor-pointer select-none">
+                <input
+                  type="checkbox"
+                  checked={newProjectTriggers}
+                  onChange={(e) => setNewProjectTriggers(e.target.checked)}
+                  className="mt-0.5 accent-[var(--accent)]"
+                />
+                <div>
+                  <div className="text-sm font-medium text-[var(--card-foreground)]">Enable status-change keyword triggers</div>
+                  <div className="text-xs text-[var(--muted-foreground)]">Automatically update issue status when commits contain closing keywords (e.g. Fixes DT-123).</div>
+                </div>
+              </label>
+              <div className="flex gap-2 justify-end">
+                <button
+                  type="submit"
+                  disabled={submittingProject}
+                  className="rounded-lg bg-[var(--accent)] px-4 py-2 text-sm font-semibold text-[var(--accent-foreground)] hover:opacity-90 disabled:opacity-60 transition-opacity"
+                >
+                  {submittingProject ? "Creating..." : "Create"}
+                </button>
+                <button
+                  type="button"
+                  onClick={() => setCreatingProject(false)}
+                  className="rounded-lg border border-[var(--border)] px-4 py-2 text-sm font-medium text-[var(--card-foreground)] hover:bg-[var(--control)] transition-colors"
+                >
+                  Cancel
+                </button>
+              </div>
+            </form>
+          )}
+
+          {loadingProjects ? (
+            <div className="flex items-center gap-2 text-sm text-[var(--muted-foreground)] py-4">
+              <svg className="animate-spin h-4 w-4" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24">
+                <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="4" />
+                <path className="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z" />
+              </svg>
+              Loading projects...
+            </div>
+          ) : projects.length === 0 ? (
+            <div className="rounded-lg border border-dashed border-[var(--border)] p-8 text-center bg-[var(--control)]/10">
+              <p className="text-sm text-[var(--muted-foreground)] mb-1">No projects created yet.</p>
+              <p className="text-xs text-[var(--muted-foreground)]">Create a project and link repositories to enable Git integration.</p>
+            </div>
+          ) : (
+            <div className="space-y-4">
+              {projects.map((proj) => {
+                const isSelected = selectedProject?.id === proj.id;
+                return (
+                  <div
+                    key={proj.id}
+                    className={`rounded-lg border transition-all duration-300 ${
+                      isSelected 
+                        ? "border-[var(--accent)] bg-[var(--control)]/10" 
+                        : "border-[var(--border)] hover:border-[var(--border-hover)]"
+                    }`}
+                  >
+                    {/* Project Header summary */}
+                    <div 
+                      onClick={() => handleSelectProject(proj)}
+                      className="p-4 flex items-center justify-between cursor-pointer select-none"
+                    >
+                      <div className="min-w-0 flex-1 pr-4">
+                        <div className="flex items-center gap-2 flex-wrap">
+                          <span className="font-semibold text-sm text-[var(--card-foreground)] truncate">
+                            {proj.name}
+                          </span>
+                          <span className="rounded bg-[var(--accent-soft)] border border-[var(--accent)]/20 px-1.5 py-0.5 text-xs font-mono font-semibold text-[var(--accent)]">
+                            {proj.key}
+                          </span>
+                        </div>
+                        {proj.description && (
+                          <p className="text-xs text-[var(--muted-foreground)] mt-1 truncate">
+                            {proj.description}
+                          </p>
+                        )}
+                      </div>
+
+                      <div className="flex items-center gap-4 shrink-0" onClick={(e) => e.stopPropagation()}>
+                        {/* Keyword triggers toggle */}
+                        <div className="flex items-center gap-2">
+                          <span className="hidden sm:inline text-xs text-[var(--muted-foreground)]">Triggers:</span>
+                          <label className="flex items-center cursor-pointer select-none">
+                            <span className="sr-only">Toggle triggers for {proj.name}</span>
+                            <div className="relative">
+                              <input
+                                type="checkbox"
+                                checked={proj.enable_keyword_triggers}
+                                onChange={(e) => handleToggleProjectTriggers(proj.id, e.target.checked)}
+                                className="sr-only"
+                              />
+                              <div
+                                className={`block h-5 w-8 rounded-full transition-colors ${
+                                  proj.enable_keyword_triggers ? "bg-[var(--accent)]" : "bg-[var(--control)]"
+                                }`}
+                              />
+                              <div
+                                className={`absolute left-0.5 top-0.5 h-4 w-4 rounded-full bg-[var(--card)] transition-transform ${
+                                  proj.enable_keyword_triggers ? "translate-x-3" : ""
+                                }`}
+                              />
+                            </div>
+                          </label>
+                        </div>
+
+                        {/* Delete project button */}
+                        <button
+                          type="button"
+                          onClick={() => handleDeleteProject(proj.id)}
+                          disabled={deletingProjectId === proj.id}
+                          className="p-1.5 text-[var(--muted-foreground)] hover:text-red-500 rounded transition-colors disabled:opacity-50"
+                          title="Delete Project"
+                        >
+                          <Trash2 className="h-4 w-4" />
+                        </button>
+                      </div>
+                    </div>
+
+                    {/* Project Expanded: repositories listing */}
+                    {isSelected && (
+                      <div className="px-4 pb-4 border-t border-[var(--border)] pt-4 space-y-4 bg-[var(--control)]/5">
+                        <div>
+                          <h4 className="text-xs font-semibold text-[var(--muted-foreground)] uppercase tracking-wider mb-2">
+                            Linked Repositories
+                          </h4>
+                          
+                          {(!selectedProject.repositories || selectedProject.repositories.length === 0) ? (
+                            <p className="text-xs text-[var(--muted-foreground)] py-2">
+                              No repositories linked. Link a repository below to auto-process push events.
+                            </p>
+                          ) : (
+                            <div className="space-y-2 mb-3">
+                              {selectedProject.repositories.map((repo: any) => (
+                                <div 
+                                  key={repo.id}
+                                  className="flex items-center justify-between rounded-md bg-[var(--control)] border border-[var(--border)] px-3 py-2 text-xs"
+                                >
+                                  <span className="font-mono truncate text-[var(--card-foreground)] max-w-xs sm:max-w-md">
+                                    {repo.repo_url}
+                                  </span>
+                                  <button
+                                    type="button"
+                                    onClick={() => handleUnlinkRepo(repo.id)}
+                                    disabled={unlinkingRepoId === repo.id}
+                                    className="text-[var(--destructive)] hover:underline flex items-center gap-1 transition-all"
+                                  >
+                                    <Unlink className="h-3.5 w-3.5" />
+                                    Unlink
+                                  </button>
+                                </div>
+                              ))}
+                            </div>
+                          )}
+
+                          {/* Link Repository Form */}
+                          <form onSubmit={handleLinkRepo} className="flex gap-2 mt-3">
+                            <input
+                              type="url"
+                              value={newRepoUrl}
+                              onChange={(e) => setNewRepoUrl(e.target.value)}
+                              placeholder="https://github.com/owner/repo or https://gitlab.com/owner/repo"
+                              required
+                              className="flex-1 rounded-lg border border-[var(--border)] bg-[var(--control)] px-3 py-1.5 text-xs text-[var(--card-foreground)] outline-none focus:border-[var(--accent)]"
+                            />
+                            <button
+                              type="submit"
+                              disabled={submittingRepo}
+                              className="rounded-lg bg-[var(--accent)] text-[var(--accent-foreground)] px-4 py-1.5 text-xs font-semibold hover:opacity-90 disabled:opacity-60 flex items-center gap-1 transition-opacity shrink-0"
+                            >
+                              <Link2 className="h-3 w-3" />
+                              Link
+                            </button>
+                          </form>
+                        </div>
+
+                        {/* Webhook integration instructions */}
+                        <div className="rounded-lg border border-[var(--border)] bg-[var(--control)]/40 p-3 text-xs text-[var(--muted-foreground)] space-y-1.5">
+                          <p className="font-semibold text-[var(--card-foreground)] flex items-center gap-1">
+                            <Settings2 className="h-3.5 w-3.5 text-[var(--accent)]" />
+                            Webhook Setup Instructions
+                          </p>
+                          <p>
+                            To process commits, configure a webhook in your repository settings:
+                          </p>
+                          <ul className="list-disc pl-4 space-y-1 mt-1 font-mono text-[11px]">
+                            <li>GitHub: Settings → Webhooks → Add Webhook
+                              <br />URL: <span className="text-[var(--accent)]">{typeof window !== "undefined" ? window.location.origin : ""}/api/webhooks/github</span>
+                            </li>
+                            <li>GitLab: Settings → Webhooks → Add Webhook
+                              <br />URL: <span className="text-[var(--accent)]">{typeof window !== "undefined" ? window.location.origin : ""}/api/webhooks/gitlab</span>
+                            </li>
+                          </ul>
+                          <p className="text-[10px] mt-1 italic">
+                            * Secret token configuration matches GITHUB_WEBHOOK_SECRET (optional).
+                          </p>
+                        </div>
+                      </div>
+                    )}
+                  </div>
+                );
+              })}
+            </div>
+          )}
+        </div>
+
         <div className="mt-6 rounded-xl border border-[var(--border)] bg-[var(--card)] p-6 shadow-sm">
           <div className="flex flex-col gap-4 md:flex-row md:items-start md:justify-between">
             <div>
diff --git a/src/lib/git-commit-linking.ts b/src/lib/git-commit-linking.ts
new file mode 100644
index 000000000..e1798e5ac
--- /dev/null
+++ b/src/lib/git-commit-linking.ts
@@ -0,0 +1,219 @@
+import { supabaseAdmin } from "./supabase";
+
+/**
+ * Normalizes a repository URL to facilitate accurate, protocol-agnostic comparison.
+ * e.g., "https://github.com/username/repo-name.git" -> "github.com/username/repo-name"
+ */
+export function normalizeRepoUrl(urlStr: string): string {
+  try {
+    const url = new URL(urlStr.trim().toLowerCase());
+    let hostname = url.hostname.replace(/^www\./, "");
+    let pathname = url.pathname.replace(/^\/|\/$/g, "").replace(/\.git$/, "");
+    return `${hostname}/${pathname}`;
+  } catch {
+    // Fallback for non-standard or malformed strings
+    return urlStr
+      .trim()
+      .toLowerCase()
+      .replace(/^https?:\/\//, "")
+      .replace(/^www\./, "")
+      .replace(/\/$/, "")
+      .replace(/\.git$/, "");
+  }
+}
+
+interface ParsedReference {
+  issueNumber: number;
+  keyword?: string;
+}
+
+/**
+ * Parses a commit message to find issue references of the format KEY-123.
+ * Optionally extracts preceding status-change trigger keywords (e.g. Fixes, Resolves).
+ */
+export function parseCommitMessage(message: string, projectKey: string): ParsedReference[] {
+  const refs: ParsedReference[] = [];
+  const escapedKey = projectKey.replace(/[-\/\\^$*+?.()|[\]{}]/g, "\\$&");
+  
+  // Regex pattern matching optional triggers, optional colon, and key-number pattern
+  // Matches e.g. "Fixes: PROJ-123", "closes PROJ-45", "PROJ-78"
+  const regex = new RegExp(
+    `\\b(fixes|fixed|fix|closes|closed|close|resolves|resolved|resolve|reviews|review|in-review)?\\s*:?\\s*\\b(${escapedKey}-(\\d+))\\b`,
+    "gi"
+  );
+
+  let match;
+  while ((match = regex.exec(message)) !== null) {
+    const keyword = match[1]?.toLowerCase();
+    const issueNumber = parseInt(match[3], 10);
+    if (!isNaN(issueNumber)) {
+      refs.push({ issueNumber, keyword });
+    }
+  }
+
+  return refs;
+}
+
+interface CommitInput {
+  id: string;
+  message: string;
+  url: string;
+  author?: {
+    name?: string;
+    email?: string;
+  };
+}
+
+const DONE_KEYWORDS = ["fixes", "fixed", "fix", "closes", "closed", "close", "resolves", "resolved", "resolve"];
+const IN_REVIEW_KEYWORDS = ["reviews", "review", "in-review"];
+
+/**
+ * Processes incoming commits, looks up matching projects and issues in the database,
+ * logs commit reference activities, and triggers status changes where applicable.
+ */
+export async function processCommits(repoUrl: string, commits: CommitInput[]): Promise<void> {
+  if (!commits || commits.length === 0) return;
+
+  const normalizedInputUrl = normalizeRepoUrl(repoUrl);
+
+  // Fetch all repository links and their corresponding projects
+  const { data: repos, error: reposError } = await supabaseAdmin
+    .from("devtrack_repositories")
+    .select("*, devtrack_projects(*)");
+
+  if (reposError) {
+    console.error("Error fetching devtrack repositories for commit linking:", reposError);
+    return;
+  }
+
+  if (!repos || repos.length === 0) return;
+
+  // Filter repos that match the normalized repository URL
+  const matchedRepos = repos.filter(
+    (r) => normalizeRepoUrl(r.repo_url) === normalizedInputUrl
+  );
+
+  if (matchedRepos.length === 0) return;
+
+  for (const r of matchedRepos) {
+    const project = r.devtrack_projects;
+    if (!project) continue;
+
+    const projectKey = project.key;
+
+    for (const commit of commits) {
+      const message = commit.message || "";
+      const parsedRefs = parseCommitMessage(message, projectKey);
+
+      if (parsedRefs.length === 0) continue;
+
+      // Deduplicate refs for the same issue, keeping the one with trigger keywords if multiple exist
+      const uniqueRefs = new Map<number, ParsedReference>();
+      for (const ref of parsedRefs) {
+        if (!uniqueRefs.has(ref.issueNumber) || ref.keyword) {
+          uniqueRefs.set(ref.issueNumber, ref);
+        }
+      }
+
+      for (const ref of uniqueRefs.values()) {
+        // Query the issue
+        const { data: issue, error: issueError } = await supabaseAdmin
+          .from("devtrack_issues")
+          .select("*")
+          .eq("project_id", project.id)
+          .eq("issue_number", ref.issueNumber)
+          .maybeSingle();
+
+        if (issueError) {
+          console.error(`Error fetching issue ${projectKey}-${ref.issueNumber}:`, issueError);
+          continue;
+        }
+
+        if (!issue) continue;
+
+        // Check if this commit was already linked to this issue (idempotency check)
+        const { data: existingActivity, error: activityError } = await supabaseAdmin
+          .from("devtrack_issue_activities")
+          .select("id")
+          .eq("issue_id", issue.id)
+          .eq("commit_hash", commit.id)
+          .maybeSingle();
+
+        if (activityError) {
+          console.error("Error checking existing issue activity:", activityError);
+          continue;
+        }
+
+        if (existingActivity) {
+          // Commit already linked, skip
+          continue;
+        }
+
+        // Insert commit_link activity
+        const commitMsgFirstLine = message.split("\n")[0] || "";
+        const authorName = commit.author?.name || "Unknown Author";
+        const cleanMessage = commitMsgFirstLine.length > 80 
+          ? `${commitMsgFirstLine.substring(0, 80)}...` 
+          : commitMsgFirstLine;
+
+        const content = `Referenced in commit [${commit.id.substring(0, 7)}](${commit.url}) by ${authorName}: "${cleanMessage}"`;
+
+        const { error: insertActError } = await supabaseAdmin
+          .from("devtrack_issue_activities")
+          .insert({
+            issue_id: issue.id,
+            type: "commit_link",
+            content,
+            commit_hash: commit.id,
+            commit_url: commit.url,
+            author_name: authorName,
+          });
+
+        if (insertActError) {
+          console.error("Failed to insert commit link activity:", insertActError);
+          continue;
+        }
+
+        // Handle trigger keywords for status changes if enabled on project
+        if (project.enable_keyword_triggers && ref.keyword) {
+          let newStatus: string | null = null;
+          
+          if (DONE_KEYWORDS.includes(ref.keyword)) {
+            newStatus = "Done";
+          } else if (IN_REVIEW_KEYWORDS.includes(ref.keyword)) {
+            newStatus = "In Review";
+          }
+
+          if (newStatus && newStatus !== issue.status) {
+            // Update issue status
+            const { error: updateIssueError } = await supabaseAdmin
+              .from("devtrack_issues")
+              .update({
+                status: newStatus,
+                updated_at: new Date().toISOString(),
+              })
+              .eq("id", issue.id);
+
+            if (updateIssueError) {
+              console.error(`Failed to update status for issue ${projectKey}-${ref.issueNumber}:`, updateIssueError);
+              continue;
+            }
+
+            // Insert status change activity
+            const { error: insertStatusActError } = await supabaseAdmin
+              .from("devtrack_issue_activities")
+              .insert({
+                issue_id: issue.id,
+                type: "status_change",
+                content: `Status changed from ${issue.status} to ${newStatus} via commit ${commit.id.substring(0, 7)}`,
+              });
+
+            if (insertStatusActError) {
+              console.error("Failed to insert status change activity:", insertStatusActError);
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/supabase/migrations/20260713000000_add_devtrack_projects_and_issues.sql b/supabase/migrations/20260713000000_add_devtrack_projects_and_issues.sql
new file mode 100644
index 000000000..80b0b036a
--- /dev/null
+++ b/supabase/migrations/20260713000000_add_devtrack_projects_and_issues.sql
@@ -0,0 +1,160 @@
+create table if not exists devtrack_projects (
+  id uuid primary key default gen_random_uuid(),
+  user_id text not null references users(id) on delete cascade,
+  name text not null,
+  key text not null check (char_length(key) >= 2 and char_length(key) <= 10),
+  description text default '',
+  enable_keyword_triggers boolean not null default true,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  unique (user_id, key)
+);
+
+alter table devtrack_projects enable row level security;
+
+create policy "devtrack_projects_select_own"
+  on devtrack_projects for select
+  using (user_id = auth.uid()::text);
+
+create policy "devtrack_projects_insert_own"
+  on devtrack_projects for insert
+  with check (user_id = auth.uid()::text);
+
+create policy "devtrack_projects_update_own"
+  on devtrack_projects for update
+  using (user_id = auth.uid()::text);
+
+create policy "devtrack_projects_delete_own"
+  on devtrack_projects for delete
+  using (user_id = auth.uid()::text);
+
+
+create table if not exists devtrack_repositories (
+  id uuid primary key default gen_random_uuid(),
+  project_id uuid not null references devtrack_projects(id) on delete cascade,
+  repo_url text not null,
+  created_at timestamptz default now(),
+  unique (project_id, repo_url)
+);
+
+alter table devtrack_repositories enable row level security;
+
+create policy "devtrack_repositories_select_own"
+  on devtrack_repositories for select
+  using (exists (
+    select 1 from devtrack_projects p
+    where p.id = project_id and p.user_id = auth.uid()::text
+  ));
+
+create policy "devtrack_repositories_insert_own"
+  on devtrack_repositories for insert
+  with check (exists (
+    select 1 from devtrack_projects p
+    where p.id = project_id and p.user_id = auth.uid()::text
+  ));
+
+create policy "devtrack_repositories_delete_own"
+  on devtrack_repositories for delete
+  using (exists (
+    select 1 from devtrack_projects p
+    where p.id = project_id and p.user_id = auth.uid()::text
+  ));
+
+
+create table if not exists devtrack_issues (
+  id uuid primary key default gen_random_uuid(),
+  project_id uuid not null references devtrack_projects(id) on delete cascade,
+  issue_number integer not null,
+  title text not null,
+  description text default '',
+  status text not null default 'Todo' check (status in ('Backlog', 'Todo', 'In Progress', 'In Review', 'Done')),
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  unique (project_id, issue_number)
+);
+
+alter table devtrack_issues enable row level security;
+
+create policy "devtrack_issues_select_own"
+  on devtrack_issues for select
+  using (exists (
+    select 1 from devtrack_projects p
+    where p.id = project_id and p.user_id = auth.uid()::text
+  ));
+
+create policy "devtrack_issues_insert_own"
+  on devtrack_issues for insert
+  with check (exists (
+    select 1 from devtrack_projects p
+    where p.id = project_id and p.user_id = auth.uid()::text
+  ));
+
+create policy "devtrack_issues_update_own"
+  on devtrack_issues for update
+  using (exists (
+    select 1 from devtrack_projects p
+    where p.id = project_id and p.user_id = auth.uid()::text
+  ));
+
+create policy "devtrack_issues_delete_own"
+  on devtrack_issues for delete
+  using (exists (
+    select 1 from devtrack_projects p
+    where p.id = project_id and p.user_id = auth.uid()::text
+  ));
+
+
+create table if not exists devtrack_issue_activities (
+  id uuid primary key default gen_random_uuid(),
+  issue_id uuid not null references devtrack_issues(id) on delete cascade,
+  type text not null check (type in ('comment', 'commit_link', 'status_change')),
+  content text not null,
+  commit_hash text,
+  commit_url text,
+  author_name text,
+  created_at timestamptz default now()
+);
+
+alter table devtrack_issue_activities enable row level security;
+
+create policy "devtrack_issue_activities_select_own"
+  on devtrack_issue_activities for select
+  using (exists (
+    select 1 from devtrack_issues i
+    join devtrack_projects p on i.project_id = p.id
+    where i.id = issue_id and p.user_id = auth.uid()::text
+  ));
+
+create policy "devtrack_issue_activities_insert_own"
+  on devtrack_issue_activities for insert
+  with check (exists (
+    select 1 from devtrack_issues i
+    join devtrack_projects p on i.project_id = p.id
+    where i.id = issue_id and p.user_id = auth.uid()::text
+  ));
+
+create policy "devtrack_issue_activities_delete_own"
+  on devtrack_issue_activities for delete
+  using (exists (
+    select 1 from devtrack_issues i
+    join devtrack_projects p on i.project_id = p.id
+    where i.id = issue_id and p.user_id = auth.uid()::text
+  ));
+
+
+-- Trigger function to auto-assign issue_number per project
+create or replace function set_devtrack_issue_number()
+returns trigger as $$
+begin
+  select coalesce(max(issue_number), 0) + 1
+  into new.issue_number
+  from devtrack_issues
+  where project_id = new.project_id;
+  return new;
+end;
+$$ language plpgsql;
+
+create or replace trigger trigger_set_devtrack_issue_number
+before insert on devtrack_issues
+for each row
+execute function set_devtrack_issue_number();
diff --git a/supabase/schema.sql b/supabase/schema.sql
index b857ceed5..871b45dd9 100644
--- a/supabase/schema.sql
+++ b/supabase/schema.sql
@@ -353,4 +353,169 @@ ALTER TABLE wakatime_stats ENABLE ROW LEVEL SECURITY;
 DROP POLICY IF EXISTS "Users can view their own wakatime stats" ON wakatime_stats;
 CREATE POLICY "Users can view their own wakatime stats"
     ON wakatime_stats FOR SELECT
-    USING (auth.uid()::text = user_id);
\ No newline at end of file
+    USING (auth.uid()::text = user_id);
+
+-- -------------------------------------------------------
+-- DevTrack Projects and Issues Tracking Tables
+-- -------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS devtrack_projects (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  key TEXT NOT NULL CHECK (char_length(key) >= 2 AND char_length(key) <= 10),
+  description TEXT DEFAULT '',
+  enable_keyword_triggers BOOLEAN NOT NULL DEFAULT TRUE,
+  created_at TIMESTAMPTZ DEFAULT now(),
+  updated_at TIMESTAMPTZ DEFAULT now(),
+  UNIQUE (user_id, key)
+);
+
+ALTER TABLE devtrack_projects ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "devtrack_projects_select_own"
+  ON devtrack_projects FOR SELECT
+  USING (user_id = auth.uid()::text);
+
+CREATE POLICY "devtrack_projects_insert_own"
+  ON devtrack_projects FOR INSERT
+  WITH CHECK (user_id = auth.uid()::text);
+
+CREATE POLICY "devtrack_projects_update_own"
+  ON devtrack_projects FOR UPDATE
+  USING (user_id = auth.uid()::text);
+
+CREATE POLICY "devtrack_projects_delete_own"
+  ON devtrack_projects FOR DELETE
+  USING (user_id = auth.uid()::text);
+
+
+CREATE TABLE IF NOT EXISTS devtrack_repositories (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id UUID NOT NULL REFERENCES devtrack_projects(id) ON DELETE CASCADE,
+  repo_url TEXT NOT NULL,
+  created_at TIMESTAMPTZ DEFAULT now(),
+  UNIQUE (project_id, repo_url)
+);
+
+ALTER TABLE devtrack_repositories ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "devtrack_repositories_select_own"
+  ON devtrack_repositories FOR SELECT
+  USING (EXISTS (
+    SELECT 1 FROM devtrack_projects p
+    WHERE p.id = project_id AND p.user_id = auth.uid()::text
+  ));
+
+CREATE POLICY "devtrack_repositories_insert_own"
+  ON devtrack_repositories FOR INSERT
+  WITH CHECK (EXISTS (
+    SELECT 1 FROM devtrack_projects p
+    WHERE p.id = project_id AND p.user_id = auth.uid()::text
+  ));
+
+CREATE POLICY "devtrack_repositories_delete_own"
+  ON devtrack_repositories FOR DELETE
+  USING (EXISTS (
+    SELECT 1 FROM devtrack_projects p
+    WHERE p.id = project_id AND p.user_id = auth.uid()::text
+  ));
+
+
+CREATE TABLE IF NOT EXISTS devtrack_issues (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id UUID NOT NULL REFERENCES devtrack_projects(id) ON DELETE CASCADE,
+  issue_number INTEGER NOT NULL,
+  title TEXT NOT NULL,
+  description TEXT DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'Todo' CHECK (status IN ('Backlog', 'Todo', 'In Progress', 'In Review', 'Done')),
+  created_at TIMESTAMPTZ DEFAULT now(),
+  updated_at TIMESTAMPTZ DEFAULT now(),
+  UNIQUE (project_id, issue_number)
+);
+
+ALTER TABLE devtrack_issues ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "devtrack_issues_select_own"
+  ON devtrack_issues FOR SELECT
+  USING (EXISTS (
+    SELECT 1 FROM devtrack_projects p
+    WHERE p.id = project_id AND p.user_id = auth.uid()::text
+  ));
+
+CREATE POLICY "devtrack_issues_insert_own"
+  ON devtrack_issues FOR INSERT
+  WITH CHECK (EXISTS (
+    SELECT 1 FROM devtrack_projects p
+    WHERE p.id = project_id AND p.user_id = auth.uid()::text
+  ));
+
+CREATE POLICY "devtrack_issues_update_own"
+  ON devtrack_issues FOR UPDATE
+  USING (EXISTS (
+    SELECT 1 FROM devtrack_projects p
+    WHERE p.id = project_id AND p.user_id = auth.uid()::text
+  ));
+
+CREATE POLICY "devtrack_issues_delete_own"
+  ON devtrack_issues FOR DELETE
+  USING (EXISTS (
+    SELECT 1 FROM devtrack_projects p
+    WHERE p.id = project_id AND p.user_id = auth.uid()::text
+  ));
+
+
+CREATE TABLE IF NOT EXISTS devtrack_issue_activities (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  issue_id UUID NOT NULL REFERENCES devtrack_issues(id) ON DELETE CASCADE,
+  type TEXT NOT NULL CHECK (type IN ('comment', 'commit_link', 'status_change')),
+  content TEXT NOT NULL,
+  commit_hash TEXT,
+  commit_url TEXT,
+  author_name TEXT,
+  created_at TIMESTAMPTZ DEFAULT now()
+);
+
+ALTER TABLE devtrack_issue_activities ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "devtrack_issue_activities_select_own"
+  ON devtrack_issue_activities FOR SELECT
+  USING (EXISTS (
+    SELECT 1 FROM devtrack_issues i
+    JOIN devtrack_projects p ON i.project_id = p.id
+    WHERE i.id = issue_id AND p.user_id = auth.uid()::text
+  ));
+
+CREATE POLICY "devtrack_issue_activities_insert_own"
+  ON devtrack_issue_activities FOR INSERT
+  WITH CHECK (EXISTS (
+    SELECT 1 FROM devtrack_issues i
+    JOIN devtrack_projects p ON i.project_id = p.id
+    WHERE i.id = issue_id AND p.user_id = auth.uid()::text
+  ));
+
+CREATE POLICY "devtrack_issue_activities_delete_own"
+  ON devtrack_issue_activities FOR DELETE
+  USING (EXISTS (
+    SELECT 1 FROM devtrack_issues i
+    JOIN devtrack_projects p ON i.project_id = p.id
+    WHERE i.id = issue_id AND p.user_id = auth.uid()::text
+  ));
+
+
+-- Trigger function to auto-assign issue_number per project
+CREATE OR REPLACE FUNCTION set_devtrack_issue_number()
+RETURNS TRIGGER AS $$
+BEGIN
+  SELECT COALESCE(MAX(issue_number), 0) + 1
+  INTO NEW.issue_number
+  FROM devtrack_issues
+  WHERE project_id = NEW.project_id;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE OR REPLACE TRIGGER trigger_set_devtrack_issue_number
+BEFORE INSERT ON devtrack_issues
+FOR EACH ROW
+EXECUTE FUNCTION set_devtrack_issue_number();
\ No newline at end of file