diff --git a/.claude/worktrees/amazing-mendel b/.claude/worktrees/amazing-mendel
deleted file mode 160000
index b6bac040..00000000
--- a/.claude/worktrees/amazing-mendel
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit b6bac040c4ede6b797ec03de1e43244c8e10f4dd
diff --git a/.claude/worktrees/determined-agnesi b/.claude/worktrees/determined-agnesi
deleted file mode 160000
index 2c73fd4e..00000000
--- a/.claude/worktrees/determined-agnesi
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 2c73fd4e30f186bedfb58bd9fdd0e39618e446df
diff --git a/.claude/worktrees/youthful-goldwasser-0b985f b/.claude/worktrees/youthful-goldwasser-0b985f
deleted file mode 160000
index 2c73fd4e..00000000
--- a/.claude/worktrees/youthful-goldwasser-0b985f
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 2c73fd4e30f186bedfb58bd9fdd0e39618e446df
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..3db063cb
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,56 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    # Weekly, Mondays at 06:30 UTC
+    - cron: "30 6 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      # Required to upload results to code scanning
+      security-events: write
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            # JavaScript/TypeScript is extracted directly from source, so no
+            # build step is needed (the Docusaurus site in website/ included).
+            build-mode: none
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          # The analysis never pushes, so keep the token out of .git/config.
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"
diff --git a/TRIAGE.md b/TRIAGE.md
index e0ce1fad..c4339da7 100644
--- a/TRIAGE.md
+++ b/TRIAGE.md
@@ -48,6 +48,15 @@ The [`stale.yml`](.github/workflows/stale.yml) workflow enforces the inactivity
 - Items labelled `pinned` or `Security` are never marked stale.
 - Any comment or update resets the clock.
 
+## Security scanning
+
+Two automated scanners run on this repository, and their findings are triaged in the same weekly session as issues and PRs:
+
+- **Dependabot** (`.github/dependabot.yml`) — checks npm dependencies in `website/` and the GitHub Actions used by the workflows, weekly on Mondays. Alerts and update PRs appear under **Security → Dependabot** and as `dependencies`-labelled PRs.
+- **CodeQL** (`.github/workflows/codeql.yml`) — static analysis (SAST) of the JavaScript/TypeScript sources on every push and pull request to `main`, plus a weekly scheduled run on Mondays. Results appear under **Security → Code scanning**. CodeQL reads source only: workflow and configuration files under `.github/` are not covered by this scan and stay a manual review item.
+
+Items labelled `Security` are never marked stale (see automation above), so a scanning alert stays visible until a maintainer closes it as fixed or dismissed with a reason.
+
 ## Roles
 
 - **Triagers**: Developer Advocates and the repository maintainers listed in [CODEOWNERS](CODEOWNERS).