diff --git a/README.md b/README.md
index 2c4925f..a5c1812 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
Token usage statistics for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness), shown as a page under **Settings → Usage** in the web GUI. The plugin aggregates persisted session logs (incrementally, via the session-projection mechanism) and never writes anything back.
-[简体中文](README.zh-CN.md) · [](https://www.npmjs.com/package/dsh-usage-panel) [](https://github.com/topics/dsh-plugin) [](LICENSE) [](https://github.com/0xsline/awesome-deepseek-harness)
+[简体中文](README.zh-CN.md) · [](https://www.npmjs.com/package/dsh-usage-panel) [](https://www.npmjs.com/package/dsh-usage-panel) [](https://github.com/AlfredChaos/dsh-usage-panel/actions/workflows/ci.yml) [](https://github.com/topics/dsh-plugin) [](https://github.com/0xsline/awesome-deepseek-harness)
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 50e8910..eeb6c10 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -4,7 +4,7 @@
[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的 Token 用量统计插件，在 Web GUI 的「设置 → 消耗统计」下展示。插件通过会话投影机制增量聚合持久化会话日志，永不写回任何数据。
-[English](README.md) · [](https://www.npmjs.com/package/dsh-usage-panel) [](https://github.com/topics/dsh-plugin) [](LICENSE) [](https://github.com/0xsline/awesome-deepseek-harness)
+[English](README.md) · [](https://www.npmjs.com/package/dsh-usage-panel) [](https://www.npmjs.com/package/dsh-usage-panel) [](https://github.com/AlfredChaos/dsh-usage-panel/actions/workflows/ci.yml) [](https://github.com/topics/dsh-plugin) [](https://github.com/0xsline/awesome-deepseek-harness)
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..953e882
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,33 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please use this repository's private vulnerability-reporting form under the GitHub **Security** tab when it is available. If it is unavailable, open a minimal issue asking the maintainer for a private contact channel; do not include exploit details in that issue.
+
+请优先通过 GitHub **Security** 页面中的私密漏洞报告功能联系维护者。如果该入口不可用，请只创建一个不含利用细节的简短 issue，请求私下沟通渠道。
+
+Never include DeepSeek API keys, session contents, raw logs, or unredacted usage data in a report.
+
+报告中不要附带 DeepSeek API key、会话内容、原始日志或未脱敏用量数据。
+
+## Scope
+
+Security fixes target the latest version on the default branch.
+
+The plugin is read-only by design: it scans persisted session logs to
+aggregate token usage statistics and never writes back. It does not
+make outbound network calls. The local RPC endpoint is bound to
+loopback only (`{ authority: 'loopback' }`).
+
+If you find a way to make the plugin write back to session logs,
+leak session content beyond the user's browser, or escape the
+loopback RPC boundary, please report it as a security issue rather
+than a regular bug.
+
+## Supported versions
+
+Only the latest released version on npm (`dsh-usage-panel@latest`)
+receives security fixes. Older versions may receive fixes at the
+maintainer's discretion.
+
+仅最新发布的 npm 版本（`dsh-usage-panel@latest`）接收安全修复。旧版本是否修复由维护者酌情决定。
diff --git a/package.json b/package.json
index 17568f6..0f31aea 100644
--- a/package.json
+++ b/package.json
@@ -72,12 +72,14 @@
"url": "git+https://github.com/AlfredChaos/dsh-usage-panel.git"
},
"keywords": [
+ "deepseek",
"deepseek-harness",
"dsh",
"dsh-plugin",
- "usage",
- "tokens",
- "statistics"
+ "token-usage",
+ "agent-analytics",
+ "typescript",
+ "usage-statistics"
],
"engines": {
"node": ">=20"