diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 00000000..012e87c0
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,35 @@
+# Redaction tests need something that looks exactly like a leaked credential,
+# because what they assert is that it never reaches output. Every fingerprint
+# below is an invented fixture that has never been valid anywhere, kept so that
+# a real leak would fail the test rather than pass unnoticed.
+#
+# Listed by fingerprint rather than by path, so this cannot quietly widen into a
+# blanket exemption: a genuine secret added to either file later produces a new
+# fingerprint and is still reported.
+#
+# Two files, two states:
+#   internal/compose/redact_test.go   present today; asserts a fake Stripe key
+#                                     never reaches rendered Compose output
+#   internal/onebox/memory_test.go    deleted in 7ad7671; the entries remain
+#                                     because the blobs stay reachable in history
+#
+# Regenerate with:
+#   gitleaks detect --no-banner --redact -v            # history
+#   gitleaks detect --no-banner --redact --no-git -v   # working tree
+
+internal/compose/redact_test.go:stripe-access-token:67
+internal/compose/redact_test.go:stripe-access-token:74
+
+4403ea605e13b8488545113c265f8e9536c5e3cd:internal/compose/redact_test.go:stripe-access-token:67
+4403ea605e13b8488545113c265f8e9536c5e3cd:internal/compose/redact_test.go:stripe-access-token:74
+842d7ae17ee7851987762106f83bf24f5ff641be:internal/compose/redact_test.go:stripe-access-token:67
+842d7ae17ee7851987762106f83bf24f5ff641be:internal/compose/redact_test.go:stripe-access-token:74
+
+091fe5765f4e2729b682c2b5df3151e321dc960b:internal/onebox/memory_test.go:generic-api-key:189
+091fe5765f4e2729b682c2b5df3151e321dc960b:internal/onebox/memory_test.go:generic-api-key:191
+091fe5765f4e2729b682c2b5df3151e321dc960b:internal/onebox/memory_test.go:jwt:199
+091fe5765f4e2729b682c2b5df3151e321dc960b:internal/onebox/memory_test.go:private-key:200
+983b111d6290bedf7720c99e4ca921d65634b892:internal/onebox/memory_test.go:generic-api-key:189
+983b111d6290bedf7720c99e4ca921d65634b892:internal/onebox/memory_test.go:generic-api-key:191
+983b111d6290bedf7720c99e4ca921d65634b892:internal/onebox/memory_test.go:jwt:199
+983b111d6290bedf7720c99e4ca921d65634b892:internal/onebox/memory_test.go:private-key:200
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 00000000..a431bb63
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,32 @@
+# Code of conduct
+
+Be straightforward and civil. Critique the change, not the person.
+
+That is the whole standard, and it is deliberately short. A longer document
+would not make anyone behave better, and this project would rather state one
+rule it will actually apply than enumerate cases it will not.
+
+## What it means in practice
+
+- Argue with the code, the design, or the evidence. Not with the author.
+- Disagreement is welcome and expected; this project changes its mind when
+  someone shows it something. Contempt is not the same as disagreement.
+- Say what you know, and say which part you are unsure about. A confident wrong
+  answer costs more than an honest question.
+- Assume the person on the other side is doing their best with what they had.
+
+## Enforcement
+
+Maintainers may remove comments, close issues and pull requests, and block
+accounts that make the project worse to participate in. That judgement rests
+with the maintainers, and it does not require a hearing.
+
+To report conduct rather than a security issue, open a private report through
+[GitHub's reporting flow](https://github.com/labstack/onebox/security/advisories/new)
+or contact the maintainers directly. Security vulnerabilities have their own
+process: see [SECURITY.md](SECURITY.md).
+
+## Scope
+
+This applies in the repository — issues, pull requests, discussions, commits and
+reviews — and anywhere someone is representing the project.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index bbbebb5d..29fe2bd6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -119,3 +119,6 @@ Do not open a public issue for a security vulnerability. See
 Be straightforward and civil. Critique the change, not the person. Maintainers
 may remove comments, close issues, and block accounts that make the project
 worse to participate in.
+
+The full text, including how to report conduct, is in
+[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).