diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..8fac23f
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,41 @@
+# CodeQL on the TypeScript and the workflows, with the security-and-quality queries: on every pull request, on main and
+# weekly for newly published queries. Results go to the Security tab; the main ruleset requires them.
+name: CodeQL
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '23 4 * * 1'
+
+permissions: {}
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      security-events: write # uploads the results
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, javascript-typescript]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-and-quality
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          category: /language:${{ matrix.language }}
diff --git a/README.md b/README.md
index 1fb5c8c..515db95 100644
--- a/README.md
+++ b/README.md
@@ -213,6 +213,12 @@ that does nothing.
     required status check.
 - **`scorecard.yml`**: [OpenSSF Scorecard](https://scorecard.dev) on pushes to `main` and weekly.
   Its own workflow because publishing results restricts what else the workflow may contain.
+- **`codeql.yml`**: CodeQL on the code and the workflows (`actions`, `javascript-typescript`) with the
+  `security-and-quality` queries, on pull requests, `main` and weekly. A workflow rather than GitHub's
+  default setup, so the queries and languages are in the repository; the `main` ruleset requires its
+  results. (Turn the default setup off: GitHub rejects a workflow's results while it is on.)
+- **`SECURITY.md`**: supported versions and a link to private vulnerability reporting (enabled in the
+  repository settings).
 - **`.github/dependabot.yml`** with a 7-day cooldown.
 - Bot actions (Dependabot auto-merge) run as the devenvy-bot GitHub App — org variable
   `DEVENVY_BOT_CLIENT_ID`, org secret `DEVENVY_BOT_PRIVATE_KEY`, both also as Dependabot secrets —
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..d9b3887
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,18 @@
+# Security
+
+## Supported versions
+
+| Version                                       | Supported                        |
+| --------------------------------------------- | -------------------------------- |
+| The latest `@devenvy/code-guidelines` release | Yes: fixes ship as a new release |
+| Older releases                                | No: update to the latest         |
+
+## Reporting a vulnerability
+
+Please report vulnerabilities privately, through GitHub's private vulnerability reporting:
+[report a vulnerability](https://github.com/devenvy/code-guidelines-ecma/security/advisories/new) (Security,
+Advisories, **Report a vulnerability**). Please don't open a public issue. You'll get an answer within a week, and the
+fix and advisory are published together.
+
+In scope: the CLI (`init`, `sync`, `check` and what they write into a repository), the shared ESLint, Prettier and
+tsconfig configurations, and the workflows. Vulnerabilities in ESLint, Prettier or their plugins belong upstream.
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 25e77ff..64d82fd 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -6,6 +6,9 @@ importers:
   .:
     configDependencies: {}
     packageManagerDependencies:
+      '@pnpm/exe':
+        specifier: 12.11.2
+        version: 12.11.2
       pnpm:
         specifier: 12.11.2
         version: 12.11.2
@@ -89,6 +92,11 @@ packages:
     cpu: [x64]
     os: [win32]
 
+  '@pnpm/exe@12.11.2':
+    resolution: {integrity: sha512-uUudrvXShgp6yYRL/6XjeB2B2kbjE/alBdVWjFBP0jDiOnV5R83OpCWuGtc+Tn4stk0DEgO/x+vhEUTUf4x+Yw==}
+    engines: {node: '>=18.*'}
+    hasBin: true
+
   pnpm@12.11.2:
     resolution: {integrity: sha512-JaUWUqGWeFr18ovabf6NxYLr76SsHRgCIc4TkCMcX7dmN4IupLbkYzznSs3LCnf3Ja8RutOBd/3t2u6BipVcuQ==}
     engines: {node: '>=18.*'}
@@ -138,6 +146,23 @@ snapshots:
   '@pnpm/exe.win32-x64@12.11.2':
     optional: true
 
+  '@pnpm/exe@12.11.2':
+    optionalDependencies:
+      '@pnpm/exe.android-arm64': 12.11.2
+      '@pnpm/exe.android-x64': 12.11.2
+      '@pnpm/exe.darwin-arm64': 12.11.2
+      '@pnpm/exe.darwin-x64': 12.11.2
+      '@pnpm/exe.freebsd-x64': 12.11.2
+      '@pnpm/exe.linux-arm64': 12.11.2
+      '@pnpm/exe.linux-arm64-musl': 12.11.2
+      '@pnpm/exe.linux-ppc64': 12.11.2
+      '@pnpm/exe.linux-riscv64': 12.11.2
+      '@pnpm/exe.linux-s390x': 12.11.2
+      '@pnpm/exe.linux-x64': 12.11.2
+      '@pnpm/exe.linux-x64-musl': 12.11.2
+      '@pnpm/exe.win32-arm64': 12.11.2
+      '@pnpm/exe.win32-x64': 12.11.2
+
   pnpm@12.11.2:
     optionalDependencies:
       '@pnpm/exe.android-arm64': 12.11.2