diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 000000000..5d36ce607
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,44 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main", "develop" ]
+  pull_request:
+    branches: [ "main", "develop" ]
+  schedule:
+    - cron: '0 0 * * 0'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'python' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        config: |
+          name: Default setup
+          queries:
+            - uses: security-and-quality
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v3
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"
diff --git a/.safety-project.ini b/.safety-project.ini
index 28ade64c6..5831ea4ab 100644
--- a/.safety-project.ini
+++ b/.safety-project.ini
@@ -1,29 +1,12 @@
-# Safety Project Configuration
-# This file pre-configures Safety CLI to prevent interactive prompts in CI environments
-
 [project]
-# Project name - prevents the "Enter a name for this codebase" prompt
-name = samo-dl
-
-# Project ID - optional but helps with consistency
+name = samo-dl-project
 id = samo-dl-project
-
-# Organization - optional
 organization = SAMO
+url = https://app.safetycli.com/codebases/samo-dl-project/findings
 
 [scan]
-# Skip interactive prompts
 interactive = false
 
-# Note: targets and continue_on_error are now specified via CLI flags
-# This allows more flexibility in different environments
-
-# [policy]
-# Policy file disabled - using command-line options instead
-# policy_file = .safety-policy.yml
-
 [output]
-# Output format for CI
 format = screen
-# Detailed output for debugging
-detailed = true
\ No newline at end of file
+detailed = true
diff --git a/scripts/check_pr_scope.py b/scripts/check_pr_scope.py
index 848e4d112..48c4941b0 100644
--- a/scripts/check_pr_scope.py
+++ b/scripts/check_pr_scope.py
@@ -166,15 +166,17 @@ def _check_single_commit(sha: str) -> bool:
 
     print(f"🔎 Checking commit {sha[:8]}: {commit_msg}")
 
-    # Check for single-purpose keywords
+    # Check for single-purpose keywords (handle scoped commits like feat(scope):)
     has_single_purpose = any(
-        commit_msg.startswith(keyword) for keyword in SINGLE_PURPOSE_KEYWORDS
+        commit_msg.startswith(keyword) or
+        commit_msg.startswith(keyword.replace(':', '('))
+        for keyword in SINGLE_PURPOSE_KEYWORDS
     )
 
     if not has_single_purpose:
         print(
             f"❌ Commit {sha[:8]} message must start with "
-            f"feat:, fix:, chore:, refactor:, docs:, or test:",
+            f"feat:, fix:, chore:, refactor:, docs:, test:, or security:",
         )
         print(f"   Message: {commit_msg}")
         return False
diff --git a/scripts/pr_scope_config.py b/scripts/pr_scope_config.py
index 41b787be7..19a62589f 100644
--- a/scripts/pr_scope_config.py
+++ b/scripts/pr_scope_config.py
@@ -62,7 +62,9 @@
 MAX_FILE_TYPES_FOR_WARNING = 2
 
 # Branch naming pattern
-BRANCH_NAME_PATTERN = r"^(feat|fix|chore|refactor|docs|test)/[a-z]+(?:-[a-z]+)*$"
+BRANCH_NAME_PATTERN = (
+    r"^(feat|fix|chore|refactor|docs|test|security)/[a-z]+(?:-[a-z]+)*$"
+)
 
 # Commit message patterns
 SINGLE_PURPOSE_KEYWORDS = [
@@ -72,6 +74,7 @@
     "refactor:",
     "docs:",
     "test:",
+    "security:",
 ]
 
 MIXING_INDICATORS = [" and ", " also ", " plus ", " & ", " in addition "]