diff --git a/astro/metadata.yml b/astro/metadata.yml
index b7075bf..fe55cc8 100644
--- a/astro/metadata.yml
+++ b/astro/metadata.yml
@@ -11,3 +11,77 @@ mounts:
     description: Astro application source code
     type: file
     required: true
+
+security_profile: {
+    "api_version": "flatrun.security-profile/v1",
+    "baseline_version": "1.0.0",
+    "version": "1.0.0",
+    "runtime": "javascript",
+    "targets": {
+      "source": {
+        "service": "app",
+        "roots": [
+          "/app"
+        ],
+        "metadata_sources": [
+          "inventory"
+        ]
+      }
+    },
+    "reviews": {
+      "runtime-files": {
+        "concern": "integrity",
+        "target": "source",
+        "runs": [
+          "incremental",
+          "full"
+        ],
+        "expectations": [
+          "Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
+        ],
+        "collect": [
+          {
+            "id": "runtime-files",
+            "image": "",
+            "command": [
+              "python3",
+              "/collectors/inventory.py",
+              "--runtime",
+              "javascript"
+            ],
+            "snapshot_paths": [
+              "."
+            ],
+            "metadata_sources": [],
+            "required": true,
+            "signals": [
+              {
+                "id": "file-indicators",
+                "kind": "json_count_gt",
+                "pointer": "/items/0/indicator_count",
+                "value": 0
+              }
+            ]
+          }
+        ]
+      }
+    },
+    "schedule": {
+      "incremental": "*/5 * * * *",
+      "retrospective": "17 * * * *",
+      "full": "0 2 * * *"
+    },
+    "budget": {
+      "timeout_seconds": 30,
+      "max_output_bytes": 65536,
+      "max_files": 10000,
+      "max_snapshot_bytes": 67108864,
+      "model_input_bytes": 131072,
+      "model_output_bytes": 32768,
+      "max_file_bytes": 1048576
+    },
+    "access_policy": {
+      "version": "1",
+      "actions": {}
+    }
+  }
diff --git a/go/docker-compose.yml b/go/docker-compose.yml
new file mode 100644
index 0000000..275e3c0
--- /dev/null
+++ b/go/docker-compose.yml
@@ -0,0 +1,15 @@
+name: ${NAME}
+services:
+  web:
+    image: golang:1.25
+    container_name: ${NAME}
+    working_dir: /workspace
+    command: /workspace/server
+    expose:
+      - "8080"
+    networks:
+      - proxy
+    restart: unless-stopped
+networks:
+  proxy:
+    external: true
diff --git a/go/metadata.yml b/go/metadata.yml
new file mode 100644
index 0000000..3fb4730
--- /dev/null
+++ b/go/metadata.yml
@@ -0,0 +1,87 @@
+name: Go
+description: Run a prebuilt Go server listening on port 8080
+logo: https://cdn.simpleicons.org/go
+category: runtime
+priority: 30
+container_port: 8080
+mounts:
+  - id: workspace
+    name: Application
+    container_path: /workspace
+    description: Prebuilt server binary and application files
+    type: file
+    required: true
+
+security_profile: {
+    "api_version": "flatrun.security-profile/v1",
+    "baseline_version": "1.0.0",
+    "version": "1.0.0",
+    "runtime": "go",
+    "targets": {
+      "source": {
+        "service": "web",
+        "roots": [
+          "/workspace"
+        ],
+        "metadata_sources": [
+          "inventory"
+        ]
+      }
+    },
+    "reviews": {
+      "runtime-files": {
+        "concern": "integrity",
+        "target": "source",
+        "runs": [
+          "incremental",
+          "full"
+        ],
+        "expectations": [
+          "Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
+        ],
+        "collect": [
+          {
+            "id": "runtime-files",
+            "image": "",
+            "command": [
+              "python3",
+              "/collectors/inventory.py",
+              "--runtime",
+              "go"
+            ],
+            "snapshot_paths": [
+              "."
+            ],
+            "metadata_sources": [],
+            "required": true,
+            "signals": [
+              {
+                "id": "file-indicators",
+                "kind": "json_count_gt",
+                "pointer": "/items/0/indicator_count",
+                "value": 0
+              }
+            ]
+          }
+        ]
+      }
+    },
+    "schedule": {
+      "incremental": "*/5 * * * *",
+      "retrospective": "17 * * * *",
+      "full": "0 2 * * *"
+    },
+    "budget": {
+      "timeout_seconds": 30,
+      "max_output_bytes": 65536,
+      "max_files": 10000,
+      "max_snapshot_bytes": 67108864,
+      "model_input_bytes": 131072,
+      "model_output_bytes": 32768,
+      "max_file_bytes": 67108864
+    },
+    "access_policy": {
+      "version": "1",
+      "actions": {}
+    }
+  }
diff --git a/laravel/metadata.yml b/laravel/metadata.yml
index 8b76b1e..0031237 100644
--- a/laravel/metadata.yml
+++ b/laravel/metadata.yml
@@ -115,3 +115,77 @@ backup:
     - service: app
       command: php artisan up
       timeout: 30
+
+security_profile: {
+    "api_version": "flatrun.security-profile/v1",
+    "baseline_version": "1.0.0",
+    "version": "1.0.0",
+    "runtime": "php",
+    "targets": {
+      "source": {
+        "service": "app",
+        "roots": [
+          "/app"
+        ],
+        "metadata_sources": [
+          "inventory"
+        ]
+      }
+    },
+    "reviews": {
+      "runtime-files": {
+        "concern": "integrity",
+        "target": "source",
+        "runs": [
+          "incremental",
+          "full"
+        ],
+        "expectations": [
+          "Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
+        ],
+        "collect": [
+          {
+            "id": "runtime-files",
+            "image": "",
+            "command": [
+              "python3",
+              "/collectors/inventory.py",
+              "--runtime",
+              "php"
+            ],
+            "snapshot_paths": [
+              "."
+            ],
+            "metadata_sources": [],
+            "required": true,
+            "signals": [
+              {
+                "id": "file-indicators",
+                "kind": "json_count_gt",
+                "pointer": "/items/0/indicator_count",
+                "value": 0
+              }
+            ]
+          }
+        ]
+      }
+    },
+    "schedule": {
+      "incremental": "*/5 * * * *",
+      "retrospective": "17 * * * *",
+      "full": "0 2 * * *"
+    },
+    "budget": {
+      "timeout_seconds": 30,
+      "max_output_bytes": 65536,
+      "max_files": 10000,
+      "max_snapshot_bytes": 67108864,
+      "model_input_bytes": 131072,
+      "model_output_bytes": 32768,
+      "max_file_bytes": 1048576
+    },
+    "access_policy": {
+      "version": "1",
+      "actions": {}
+    }
+  }
diff --git a/nextcloud/metadata.yml b/nextcloud/metadata.yml
index b955a25..f76fcda 100644
--- a/nextcloud/metadata.yml
+++ b/nextcloud/metadata.yml
@@ -26,3 +26,77 @@ mounts:
     type: file
     required: false
     user: "33:33"
+
+security_profile: {
+    "api_version": "flatrun.security-profile/v1",
+    "baseline_version": "1.0.0",
+    "version": "1.0.0",
+    "runtime": "php",
+    "targets": {
+      "source": {
+        "service": "app",
+        "roots": [
+          "/var/www/html"
+        ],
+        "metadata_sources": [
+          "inventory"
+        ]
+      }
+    },
+    "reviews": {
+      "runtime-files": {
+        "concern": "integrity",
+        "target": "source",
+        "runs": [
+          "incremental",
+          "full"
+        ],
+        "expectations": [
+          "Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
+        ],
+        "collect": [
+          {
+            "id": "runtime-files",
+            "image": "",
+            "command": [
+              "python3",
+              "/collectors/inventory.py",
+              "--runtime",
+              "php"
+            ],
+            "snapshot_paths": [
+              "."
+            ],
+            "metadata_sources": [],
+            "required": true,
+            "signals": [
+              {
+                "id": "file-indicators",
+                "kind": "json_count_gt",
+                "pointer": "/items/0/indicator_count",
+                "value": 0
+              }
+            ]
+          }
+        ]
+      }
+    },
+    "schedule": {
+      "incremental": "*/5 * * * *",
+      "retrospective": "17 * * * *",
+      "full": "0 2 * * *"
+    },
+    "budget": {
+      "timeout_seconds": 30,
+      "max_output_bytes": 65536,
+      "max_files": 10000,
+      "max_snapshot_bytes": 67108864,
+      "model_input_bytes": 131072,
+      "model_output_bytes": 32768,
+      "max_file_bytes": 1048576
+    },
+    "access_policy": {
+      "version": "1",
+      "actions": {}
+    }
+  }
diff --git a/nextjs/metadata.yml b/nextjs/metadata.yml
index ebed660..28e35b9 100644
--- a/nextjs/metadata.yml
+++ b/nextjs/metadata.yml
@@ -11,3 +11,77 @@ mounts:
     description: Next.js application source code
     type: file
     required: true
+
+security_profile: {
+    "api_version": "flatrun.security-profile/v1",
+    "baseline_version": "1.0.0",
+    "version": "1.0.0",
+    "runtime": "javascript",
+    "targets": {
+      "source": {
+        "service": "app",
+        "roots": [
+          "/app"
+        ],
+        "metadata_sources": [
+          "inventory"
+        ]
+      }
+    },
+    "reviews": {
+      "runtime-files": {
+        "concern": "integrity",
+        "target": "source",
+        "runs": [
+          "incremental",
+          "full"
+        ],
+        "expectations": [
+          "Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
+        ],
+        "collect": [
+          {
+            "id": "runtime-files",
+            "image": "",
+            "command": [
+              "python3",
+              "/collectors/inventory.py",
+              "--runtime",
+              "javascript"
+            ],
+            "snapshot_paths": [
+              "."
+            ],
+            "metadata_sources": [],
+            "required": true,
+            "signals": [
+              {
+                "id": "file-indicators",
+                "kind": "json_count_gt",
+                "pointer": "/items/0/indicator_count",
+                "value": 0
+              }
+            ]
+          }
+        ]
+      }
+    },
+    "schedule": {
+      "incremental": "*/5 * * * *",
+      "retrospective": "17 * * * *",
+      "full": "0 2 * * *"
+    },
+    "budget": {
+      "timeout_seconds": 30,
+      "max_output_bytes": 65536,
+      "max_files": 10000,
+      "max_snapshot_bytes": 67108864,
+      "model_input_bytes": 131072,
+      "model_output_bytes": 32768,
+      "max_file_bytes": 1048576
+    },
+    "access_policy": {
+      "version": "1",
+      "actions": {}
+    }
+  }
diff --git a/node/metadata.yml b/node/metadata.yml
index c2694f7..0c0469f 100644
--- a/node/metadata.yml
+++ b/node/metadata.yml
@@ -11,3 +11,77 @@ mounts:
     description: Node.js application source code
     type: file
     required: true
+
+security_profile: {
+    "api_version": "flatrun.security-profile/v1",
+    "baseline_version": "1.0.0",
+    "version": "1.0.0",
+    "runtime": "javascript",
+    "targets": {
+      "source": {
+        "service": "app",
+        "roots": [
+          "/app"
+        ],
+        "metadata_sources": [
+          "inventory"
+        ]
+      }
+    },
+    "reviews": {
+      "runtime-files": {
+        "concern": "integrity",
+        "target": "source",
+        "runs": [
+          "incremental",
+          "full"
+        ],
+        "expectations": [
+          "Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
+        ],
+        "collect": [
+          {
+            "id": "runtime-files",
+            "image": "",
+            "command": [
+              "python3",
+              "/collectors/inventory.py",
+              "--runtime",
+              "javascript"
+            ],
+            "snapshot_paths": [
+              "."
+            ],
+            "metadata_sources": [],
+            "required": true,
+            "signals": [
+              {
+                "id": "file-indicators",
+                "kind": "json_count_gt",
+                "pointer": "/items/0/indicator_count",
+                "value": 0
+              }
+            ]
+          }
+        ]
+      }
+    },
+    "schedule": {
+      "incremental": "*/5 * * * *",
+      "retrospective": "17 * * * *",
+      "full": "0 2 * * *"
+    },
+    "budget": {
+      "timeout_seconds": 30,
+      "max_output_bytes": 65536,
+      "max_files": 10000,
+      "max_snapshot_bytes": 67108864,
+      "model_input_bytes": 131072,
+      "model_output_bytes": 32768,
+      "max_file_bytes": 1048576
+    },
+    "access_policy": {
+      "version": "1",
+      "actions": {}
+    }
+  }
diff --git a/php/metadata.yml b/php/metadata.yml
index 4a0c93d..84668c9 100644
--- a/php/metadata.yml
+++ b/php/metadata.yml
@@ -11,3 +11,77 @@ mounts:
     description: PHP application files
     type: file
     required: true
+
+security_profile: {
+    "api_version": "flatrun.security-profile/v1",
+    "baseline_version": "1.0.0",
+    "version": "1.0.0",
+    "runtime": "php",
+    "targets": {
+      "source": {
+        "service": "app",
+        "roots": [
+          "/var/www/html"
+        ],
+        "metadata_sources": [
+          "inventory"
+        ]
+      }
+    },
+    "reviews": {
+      "runtime-files": {
+        "concern": "integrity",
+        "target": "source",
+        "runs": [
+          "incremental",
+          "full"
+        ],
+        "expectations": [
+          "Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
+        ],
+        "collect": [
+          {
+            "id": "runtime-files",
+            "image": "",
+            "command": [
+              "python3",
+              "/collectors/inventory.py",
+              "--runtime",
+              "php"
+            ],
+            "snapshot_paths": [
+              "."
+            ],
+            "metadata_sources": [],
+            "required": true,
+            "signals": [
+              {
+                "id": "file-indicators",
+                "kind": "json_count_gt",
+                "pointer": "/items/0/indicator_count",
+                "value": 0
+              }
+            ]
+          }
+        ]
+      }
+    },
+    "schedule": {
+      "incremental": "*/5 * * * *",
+      "retrospective": "17 * * * *",
+      "full": "0 2 * * *"
+    },
+    "budget": {
+      "timeout_seconds": 30,
+      "max_output_bytes": 65536,
+      "max_files": 10000,
+      "max_snapshot_bytes": 67108864,
+      "model_input_bytes": 131072,
+      "model_output_bytes": 32768,
+      "max_file_bytes": 1048576
+    },
+    "access_policy": {
+      "version": "1",
+      "actions": {}
+    }
+  }
diff --git a/python/docker-compose.yml b/python/docker-compose.yml
new file mode 100644
index 0000000..5acebdb
--- /dev/null
+++ b/python/docker-compose.yml
@@ -0,0 +1,15 @@
+name: ${NAME}
+services:
+  web:
+    image: python:3.13-slim
+    container_name: ${NAME}
+    working_dir: /workspace
+    command: python main.py
+    expose:
+      - "8000"
+    networks:
+      - proxy
+    restart: unless-stopped
+networks:
+  proxy:
+    external: true
diff --git a/python/metadata.yml b/python/metadata.yml
new file mode 100644
index 0000000..7db312e
--- /dev/null
+++ b/python/metadata.yml
@@ -0,0 +1,87 @@
+name: Python
+description: Run a Python application listening on port 8000
+logo: https://cdn.simpleicons.org/python
+category: runtime
+priority: 30
+container_port: 8000
+mounts:
+  - id: workspace
+    name: Application
+    container_path: /workspace
+    description: Application files including main.py and installed dependencies
+    type: file
+    required: true
+
+security_profile: {
+    "api_version": "flatrun.security-profile/v1",
+    "baseline_version": "1.0.0",
+    "version": "1.0.0",
+    "runtime": "python",
+    "targets": {
+      "source": {
+        "service": "web",
+        "roots": [
+          "/workspace"
+        ],
+        "metadata_sources": [
+          "inventory"
+        ]
+      }
+    },
+    "reviews": {
+      "runtime-files": {
+        "concern": "integrity",
+        "target": "source",
+        "runs": [
+          "incremental",
+          "full"
+        ],
+        "expectations": [
+          "Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
+        ],
+        "collect": [
+          {
+            "id": "runtime-files",
+            "image": "",
+            "command": [
+              "python3",
+              "/collectors/inventory.py",
+              "--runtime",
+              "python"
+            ],
+            "snapshot_paths": [
+              "."
+            ],
+            "metadata_sources": [],
+            "required": true,
+            "signals": [
+              {
+                "id": "file-indicators",
+                "kind": "json_count_gt",
+                "pointer": "/items/0/indicator_count",
+                "value": 0
+              }
+            ]
+          }
+        ]
+      }
+    },
+    "schedule": {
+      "incremental": "*/5 * * * *",
+      "retrospective": "17 * * * *",
+      "full": "0 2 * * *"
+    },
+    "budget": {
+      "timeout_seconds": 30,
+      "max_output_bytes": 65536,
+      "max_files": 10000,
+      "max_snapshot_bytes": 67108864,
+      "model_input_bytes": 131072,
+      "model_output_bytes": 32768,
+      "max_file_bytes": 1048576
+    },
+    "access_policy": {
+      "version": "1",
+      "actions": {}
+    }
+  }
diff --git a/wordpress/metadata.yml b/wordpress/metadata.yml
index 122abd9..5ecd4d1 100644
--- a/wordpress/metadata.yml
+++ b/wordpress/metadata.yml
@@ -55,3 +55,77 @@ backup:
     - service: wordpress
       command: wp maintenance-mode deactivate --allow-root || true
       timeout: 30
+
+security_profile: {
+    "api_version": "flatrun.security-profile/v1",
+    "baseline_version": "1.0.0",
+    "version": "1.0.0",
+    "runtime": "php",
+    "targets": {
+      "source": {
+        "service": "wordpress",
+        "roots": [
+          "/var/www/html"
+        ],
+        "metadata_sources": [
+          "inventory"
+        ]
+      }
+    },
+    "reviews": {
+      "runtime-files": {
+        "concern": "integrity",
+        "target": "source",
+        "runs": [
+          "incremental",
+          "full"
+        ],
+        "expectations": [
+          "Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
+        ],
+        "collect": [
+          {
+            "id": "runtime-files",
+            "image": "",
+            "command": [
+              "python3",
+              "/collectors/inventory.py",
+              "--runtime",
+              "php"
+            ],
+            "snapshot_paths": [
+              "."
+            ],
+            "metadata_sources": [],
+            "required": true,
+            "signals": [
+              {
+                "id": "file-indicators",
+                "kind": "json_count_gt",
+                "pointer": "/items/0/indicator_count",
+                "value": 0
+              }
+            ]
+          }
+        ]
+      }
+    },
+    "schedule": {
+      "incremental": "*/5 * * * *",
+      "retrospective": "17 * * * *",
+      "full": "0 2 * * *"
+    },
+    "budget": {
+      "timeout_seconds": 30,
+      "max_output_bytes": 65536,
+      "max_files": 10000,
+      "max_snapshot_bytes": 67108864,
+      "model_input_bytes": 131072,
+      "model_output_bytes": 32768,
+      "max_file_bytes": 1048576
+    },
+    "access_policy": {
+      "version": "1",
+      "actions": {}
+    }
+  }