ci(security): add CI matrix, CodeQL SAST, Dependabot, CODEOWNERS, and issue templates

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Global Code Owners
+# Maintained by Dennis Westermann and trusted-coders
+* @cubetribe @VibecodingGermany/trusted-coders

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,37 @@
+name: 🐛 Bug Report
+description: Report a bug or unexpected behavior in VCG Forum MCP
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report an issue! Please provide as much detail as possible.
+  - type: input
+    id: version
+    attributes:
+      label: VCG Forum MCP Version
+      description: What version are you using? (Run `vcg-forum-mcp --version` or check your npx output)
+      placeholder: e.g. 0.1.0
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment & AI Client
+      description: OS and AI client where the issue occurred
+      placeholder: e.g. macOS Sequoia 15.2 / Claude Code 1.0.18 / Claude Desktop / Antigravity
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Describe the bug and what you expected to happen instead.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant Log Output
+      description: Please copy and paste any relevant terminal output (ensure no secrets are included!).
+      render: shell

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 💬 VibeCoding Germany Community Forum
+    url: https://forum.vibecoding-germany.de
+    about: Ask questions, discuss workflows, or share your MCP setups with the community!
+  - name: 🔒 Report a Security Vulnerability
+    url: mailto:hey@dennis-westermann.de
+    about: Please report security vulnerabilities privately via email.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,22 @@
+name: ✨ Feature Request / Improvement
+description: Suggest an idea or tool improvement for VCG Forum MCP
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Have an idea to make VCG Forum MCP better? We would love to hear it!
+  - type: textarea
+    id: feature-description
+    attributes:
+      label: Feature / Tool Description
+      description: What tool or functionality would you like to see added?
+    validations:
+      required: true
+  - type: textarea
+    id: use-case
+    attributes:
+      label: Use Case / AI Workflow
+      description: How would you use this with your AI assistant (Claude Code, Desktop, Cursor, etc.)?
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+## Description
+<!-- Provide a clear, brief explanation of what changes this PR introduces. -->
+
+## Type of Change
+- [ ] 🐛 Bugfix (non-breaking fix)
+- [ ] ✨ Feature (non-breaking feature addition)
+- [ ] 🔒 Security (security patch or vulnerability mitigation)
+- [ ] 📝 Documentation (updates to README, SETUP, or guides)
+- [ ] 🔧 Refactor / Tooling (internal code cleanup, CI, or tests)
+
+## Verification
+<!-- How did you test and verify these changes? -->
+- [ ] Local smoke test / CLI test passed
+- [ ] Tested against live/mock Discourse endpoint
+- [ ] CI matrix passed
+
+## Checklist
+- [ ] My code follows the repository conventions and coding guidelines.
+- [ ] I have updated the documentation where appropriate.
+- [ ] No sensitive credentials or tokens are committed.

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    groups:
+      dependencies:
+        patterns:
+          - "*"
+    labels:
+      - "dependencies"
+      - "security"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    labels:
+      - "github-actions"
+      - "security"

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - 'codex/**'
+      - 'feat/**'
+      - 'fix/**'
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test & Smoke Check
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        node-version: [18.x, 20.x, 22.x]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Verify CLI Version & Help
+        run: |
+          node src/cli.js --version
+          node src/cli.js --help
+          node src/cli.js config
+
+      - name: Smoke Test (CLI Entrypoint & Arg Parser)
+        run: |
+          node -e "import('./src/cli.js');" -- --help

.github/workflows/codeql.yml

@@ -0,0 +1,32 @@
+name: "CodeQL Security Analysis"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '35 6 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (JavaScript)
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: 'javascript-typescript'
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:javascript-typescript"

.github/workflows/security-audit.yml

@@ -0,0 +1,28 @@
+name: Security Audit
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '0 0 * * 0' # Weekly on Sunday
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: NPM Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+
+      - name: Run npm audit
+        run: npm audit --audit-level=high || true

SECURITY.md

@@ -78,11 +78,11 @@ Neither this wrapper nor `@discourse/mcp` runs any install-time scripts (`preins
 If you find a security issue in this wrapper:
 
 1. **Do not open a public GitHub issue.**
-2. **Email** `cubetribe@googlemail.com` with:
+2. **Email** `hey@dennis-westermann.de` with:
    - A description of the vulnerability
    - Steps to reproduce (if applicable)
    - Potential impact
-3. We will investigate and coordinate a fix/release.
+3. We will acknowledge receipt within 48 hours and coordinate a fix/release.
 
 ## Secret management