Enable CodeQL security scanning

.github/workflows/codeql.yml

@@ -0,0 +1,60 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '23 6 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze-python:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: python
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:python
+
+  analyze-swift:
+    name: Analyze Swift
+    runs-on: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: swift
+          build-mode: manual
+
+      - name: Build Swift target
+        run: >-
+          xcodebuild
+          -project CodexBuddyMac/CodexBuddyMac.xcodeproj
+          -scheme CodexBuddyMac
+          -configuration Debug
+          -sdk macosx
+          ARCHS="$(uname -m)"
+          CODE_SIGNING_ALLOWED=NO
+          build
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:swift

CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to CodexBuddyMac are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## Unreleased
+
+### Added
+
+- **Continuous GitHub security scanning.** CodeQL now analyzes the Python
+  bridge and Swift app on pull requests, pushes to `main`, and a weekly
+  schedule. Dependabot alerts and security updates are enabled.
+
 ## [1.1.2] — 2026-07-14
 
 ### Fixed

README.md

@@ -96,6 +96,9 @@ Open Settings from the menu to:
   require a private loopback token written to a `0600` file, and login refresh is
   rate-limited, so a stray local process or browser cannot trigger a token
   refresh. Usage responses are cached locally and are not uploaded by CodexBuddyMac.
+- GitHub Secret Scanning with push protection, Dependabot alerts and security
+  updates, and CodeQL run continuously to catch exposed credentials,
+  vulnerable dependencies, and code-security issues.
 - Do not commit local logs, build products, user data, credentials, or signing
   profiles. The included `.gitignore` excludes these files (including the runtime
   token, lock, PID, and retry-state files).