diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index a83f0fa..1d84e17 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -6,9 +6,9 @@
     {
       "name": "dev",
       "source": "./plugins/dev",
-      "description": "17 Skills: App-Design, UX/Human-AI Interaction Design & Review (HAX/PAIR/CHI 2024), Security Code Review (ISEC/Stanford/MIT-basiert), App-Audit (6 Achsen, ASVS 5.0), Architektur-Review, Debug-Assistent, Test-Strategie, CSS-Styling.",
+      "description": "24 skills for software projects: Design (App, Secure, API, Data, Migration, UX, LLM, Observability, CI/CD, IaC), Review (App, Architecture, Security, UX, LLM), Tools (Debug, Test, Style, Accessibility, Performance), Meta. Grounded in MIT, CMU, Stanford curricula.",
       "category": "development",
-      "tags": ["audit", "architecture", "security", "ci-cd", "best-practices"]
+      "tags": ["best-practices", "security", "architecture", "llm", "accessibility", "performance", "ci-cd", "iac"]
     }
   ]
 }
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..305461d
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gerald Fruhmann
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..b2b6f8f
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,25 @@
+# Security Policy
+
+## Supported Versions
+
+This repository contains documentation and Claude Code plugin skills — no executable code.
+All versions receive updates.
+
+## Reporting a Vulnerability
+
+If you discover a security issue (e.g. a skill workflow that could be used for prompt injection,
+a rule that introduces a vulnerability into projects, or sensitive data accidentally committed):
+
+1. **Do not open a public issue.**
+2. Report privately via [GitHub Security Advisories](https://github.com/gerfru/dev-best-practices/security/advisories/new).
+3. Include: what you found, which file/skill, potential impact.
+
+You will receive a response within 7 days.
+
+## Scope
+
+- Skill workflows that give insecure advice (e.g. recommending weak crypto, bypassing auth)
+- Rules in `claude/` or `reference/` that would introduce OWASP Top 10 vulnerabilities into projects
+- Any accidentally committed credentials or personal data
+
+Out of scope: general disagreements with best-practice recommendations (open an issue instead).