diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..0e0cacc
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..3b22322
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,16 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security issues **privately** using GitHub's private
+vulnerability reporting on this repository (**Security → Report a
+vulnerability**). Do not open a public issue for a security problem.
+
+Include a description, the affected version or commit, reproduction steps, and
+the impact. We aim to acknowledge reports within a few business days.
+
+## Scope
+
+This repository is part of the [Heretek Games](https://github.com/Heretek-Games)
+workspace. See [`drop`'s SECURITY.md](https://github.com/Heretek-Games/drop/blob/develop/SECURITY.md)
+for the platform-wide policy.