diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..9860f47
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,43 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.0.0] - Unreleased
+
+### Added
+
+- Initial public release of SemaFore for GitHub Actions.
+- Notify mode with recipient resolution and per-device X3DH/Double Ratchet
+  encryption before delivery through the ADR-0166 integration API.
+- Execute mode with `create_thread`, `archive_thread`, and `audit_event` actions.
+- Bootstrap Action for one-time device registration, local key generation, and
+  encrypted writeback to GitHub Actions secrets.
+- Sensitive-input origin and placeholder checks, log masking, bounded HTTP
+  timeouts, and retries for safe transient failures.
+- GitHub repository-secret helper with public-key fetch, libsodium sealed-box
+  encryption, and create-or-update support.
+- Bundled `dist/` runtime containing `@attomus/semafore-crypto` v1.0.1 inline.
+- CI verification for linting, type-checking, tests, bundle freshness,
+  dependency audit, and secret scanning.
+
+### Security
+
+- Notification content is end-to-end encrypted in the GitHub runner for each
+  recipient device using X3DH and Double Ratchet; SemaFore routes ciphertext
+  envelopes and cannot read the notification content.
+- Bootstrap private-key material is generated in the runner and sealed to
+  GitHub's repository public key before upload.
+- The committed runtime bundle is excluded from duplicate gitleaks inspection;
+  its source and the remainder of the full Git history remain scanned.
+
+### Dependencies
+
+- Runtime dependency on `@attomus/semafore-crypto` `^1.0.0`.
+
+[Unreleased]: https://github.com/Attomus/semafore-github-action/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/Attomus/semafore-github-action/releases/tag/v1.0.0
diff --git a/README.md b/README.md
index 872ad03..59e1d7a 100644
--- a/README.md
+++ b/README.md
@@ -122,6 +122,7 @@ the `SEMAFORE_GITHUB_SECRET_TOKEN` repository secret.
 
 Tagged `v1.x.x` releases will become Marketplace versions once the Action is
 ready. The floating `v1` tag will point to the latest compatible v1 release.
+Release history is recorded in [CHANGELOG.md](./CHANGELOG.md).
 
 ## Responsible Disclosure
 
diff --git a/SECURITY.md b/SECURITY.md
index ccdf04b..0338f54 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,6 +1,47 @@
 # Security Policy
 
-Please report suspected vulnerabilities privately to `security@attomus.com`.
+## Reporting Security Issues
 
-Do not open public issues for vulnerabilities, secrets, private keys, token
-material, or workflow configurations that could expose a customer environment.
+Report suspected vulnerabilities privately to `security@attomus.com`. You can
+also use a private vulnerability report from this repository's **Security** tab.
+
+Please include reproduction steps, the affected version, the expected impact,
+and any relevant workflow excerpts, test vectors, or wire bytes. Do not include
+real credentials, tokens, private keys, or customer data, and do not open a
+public issue for a suspected vulnerability.
+
+## Supported Versions
+
+| Version | Supported |
+| --- | --- |
+| 1.x | Yes |
+| Pre-release versions earlier than 1.0.0 | No |
+
+Security fixes are made against the latest compatible v1 release. Users should
+follow the floating `v1` tag or update to the latest `v1.x.x` tag.
+
+## Scope
+
+In scope:
+
+- the Action and bootstrap Action code in this repository;
+- the `@attomus/semafore-crypto` code bundled into `dist/`;
+- handling of service tokens, device keys, and bootstrap key material; and
+- the encrypted notification and execute wire formats emitted by the Action.
+
+Out of scope:
+
+- vulnerabilities in GitHub Actions or a reporter's own workflow configuration
+  that are not caused by this Action;
+- general SemaFore product or infrastructure issues, which should be reported
+  through the [main SemaFore disclosure policy](https://attomus.com/security/);
+  and
+- vulnerabilities in third-party dependencies that do not arise from how this
+  Action uses them, which should be reported to the upstream maintainer.
+
+## Response Commitment
+
+Attomus aims to acknowledge reports within 48 hours and provide an initial
+assessment, including severity and an expected remediation timeline, within
+7 days. We will coordinate a fix and disclosure date with the reporter
+before details are made public.
diff --git a/package-lock.json b/package-lock.json
index bca3d5d..539e945 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1459,9 +1459,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "dev": true,
       "funding": [
         {
@@ -2005,9 +2005,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.17",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
-      "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {