diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..1d8caa1
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,9 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
+# Contributing
+
+1. Fork the repository
+2. Create a feature branch
+3. Ensure SPDX headers on all files
+4. Submit a pull request
+
+**Author:** Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..ff9b45b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,13 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
+# Security Policy
+
+## Reporting a Vulnerability
+
+**Email:** j.d.a.jewell@open.ac.uk
+
+**Response timeline:**
+- Acknowledgement within 48 hours
+- Initial assessment within 7 days
+- Fix or mitigation within 90 days
+
+**Safe harbour:** We will not pursue legal action against security researchers who follow responsible disclosure.