diff --git a/resources/views/components/footer.blade.php b/resources/views/components/footer.blade.php
index 693456dc..94d80427 100644
--- a/resources/views/components/footer.blade.php
+++ b/resources/views/components/footer.blade.php
@@ -321,6 +321,22 @@ class="inline-block px-px py-1.5 transition duration-300 will-change-transform h
                         </li>
                     @endfeature
 
+                    <li>
+                        <a
+                            href="{{ route('contributing') }}"
+                            class="inline-block px-px py-1.5 transition duration-300 will-change-transform hover:translate-x-1 hover:text-gray-700 dark:hover:text-gray-300"
+                        >
+                            Contributing
+                        </a>
+                    </li>
+                    <li>
+                        <a
+                            href="{{ route('security') }}"
+                            class="inline-block px-px py-1.5 transition duration-300 will-change-transform hover:translate-x-1 hover:text-gray-700 dark:hover:text-gray-300"
+                        >
+                            Security
+                        </a>
+                    </li>
                     <li>
                         <a
                             href="{{ route('brand') }}"
diff --git a/resources/views/contributing.blade.php b/resources/views/contributing.blade.php
new file mode 100644
index 00000000..04ca858b
--- /dev/null
+++ b/resources/views/contributing.blade.php
@@ -0,0 +1,340 @@
+<x-layout title="Contributing">
+    {{-- Hero --}}
+    <section
+        class="mx-auto mt-10 w-full max-w-3xl md:mt-14"
+        aria-labelledby="article-title"
+    >
+        <header class="relative grid place-items-center text-center">
+            {{-- Blurred circle - Decorative --}}
+            <div
+                class="absolute top-0 right-1/2 -z-30 h-60 w-60 translate-x-1/2 rounded-full blur-[150px] md:w-80 dark:bg-slate-500/50"
+                aria-hidden="true"
+            ></div>
+
+            {{-- Primary Heading --}}
+            <h1
+                id="article-title"
+                x-init="
+                    () => {
+                        motion.inView($el, (element) => {
+                            motion.animate(
+                                $el,
+                                {
+                                    opacity: [0, 1],
+                                    x: [-5, 0],
+                                },
+                                {
+                                    duration: 0.7,
+                                    ease: motion.easeOut,
+                                },
+                            )
+                        })
+                    }
+                "
+                class="mt-8 text-3xl font-extrabold will-change-transform sm:text-4xl"
+            >
+                Contributing to NativePHP
+            </h1>
+
+            {{-- Subtitle --}}
+            <p class="max-w-xl pt-4 text-gray-600 dark:text-gray-400">
+                Bug fixes, new features, documentation and bug reports all help
+                make NativePHP better. Thank you for helping out.
+            </p>
+        </header>
+
+        {{-- Divider --}}
+        <x-divider />
+
+        {{-- Content --}}
+        <article
+            x-init="
+                () => {
+                    motion.inView($el, (element) => {
+                        motion.animate(
+                            $el,
+                            {
+                                opacity: [0, 1],
+                                y: [5, 0],
+                            },
+                            {
+                                duration: 0.7,
+                                ease: motion.easeOut,
+                            },
+                        )
+                    })
+                }
+            "
+            class="prose mt-2 max-w-none text-gray-600 will-change-transform dark:text-gray-400 dark:prose-headings:text-white"
+            aria-labelledby="article-title"
+        >
+            <h2>Where to contribute</h2>
+
+            <p>
+                NativePHP is split across a few repositories on GitHub. Pick the
+                one your change belongs to:
+            </p>
+
+            <ul>
+                <li>
+                    <strong>NativePHP for Mobile</strong>
+                    lives in
+                    <a href="https://github.com/NativePHP/mobile-air">
+                        NativePHP/mobile-air
+                    </a>
+                </li>
+                <li>
+                    <strong>NativePHP for Desktop</strong>
+                    lives in
+                    <a href="https://github.com/NativePHP/desktop">
+                        NativePHP/desktop
+                    </a>
+                </li>
+                <li>
+                    <strong>The documentation and this website</strong>
+                    live in
+                    <a href="https://github.com/NativePHP/nativephp.com">
+                        NativePHP/nativephp.com
+                    </a>
+                </li>
+                <li>
+                    <strong>Official plugins</strong>
+                    that are open source each have their own repository in the
+                    <a href="https://github.com/NativePHP">NativePHP</a>
+                    organization
+                </li>
+            </ul>
+
+            <h2>How to contribute</h2>
+
+            <ol>
+                <li>
+                    <strong>Fork the repository</strong>
+                    to your own GitHub account.
+                </li>
+                <li>
+                    <strong>Clone your fork</strong>
+                    locally:
+                    <pre><code class="torchlight"><div class="line">git clone git@github.com:your-username/mobile-air.git</div><div class="line">cd mobile-air</div></code></pre>
+                </li>
+                <li>
+                    <strong>Create a branch</strong>
+                    with a name that describes your change:
+                    <pre><code class="torchlight"><div class="line">git checkout -b feature/my-new-feature</div></code></pre>
+                </li>
+                <li>
+                    <strong>Make your changes</strong>
+                    and follow the code style of the repository you're working
+                    in.
+                </li>
+                <li>
+                    <strong>Test your changes</strong>
+                    to make sure they work as intended and don't break anything
+                    else.
+                </li>
+                <li>
+                    <strong>Commit your changes</strong>
+                    with clear messages that explain what changed and why.
+                </li>
+                <li>
+                    <strong>Push your branch</strong>
+                    to your fork:
+                    <pre><code class="torchlight"><div class="line">git push origin feature/my-new-feature</div></code></pre>
+                </li>
+                <li>
+                    <strong>Open a pull request</strong>
+                    against the
+                    <code>main</code>
+                    branch of the original repository. Describe the change, the
+                    problem it solves and anything a reviewer should know.
+                </li>
+                <li>
+                    <strong>Respond to review.</strong>
+                    A maintainer will review your pull request and may ask for
+                    changes. Once it's approved, it gets merged.
+                </li>
+            </ol>
+
+            <h2>Pull request guidelines</h2>
+
+            <ul>
+                <li>
+                    Keep each pull request focused. Send unrelated changes as
+                    separate pull requests.
+                </li>
+                <li>Write clear, descriptive commit messages.</li>
+                <li>Include tests for any new functionality.</li>
+                <li>Make sure all existing tests pass before you submit.</li>
+                <li>
+                    Update the documentation if your change affects the public
+                    API.
+                </li>
+            </ul>
+
+            <h2>Code style and tests</h2>
+
+            <p>
+                Follow the conventions of the code around your change. The
+                mobile and desktop packages use
+                <a href="https://laravel.com/docs/pint">Laravel Pint</a>
+                for formatting, PHPStan for static analysis and Pest for tests.
+                You can run all three before you push:
+            </p>
+
+            <pre><code class="torchlight"><div class="line">composer qa</div></code></pre>
+
+            <p>Each step also has its own command:</p>
+
+            <ul>
+                <li><code>composer format</code></li>
+                <li><code>composer analyse</code></li>
+                <li><code>composer test</code></li>
+            </ul>
+
+            <h2>Reporting bugs</h2>
+
+            <p>
+                If you find a bug, open an issue on the repository it affects.
+                The
+                <a href="https://github.com/NativePHP/mobile-air/issues">
+                    mobile
+                </a>
+                and
+                <a href="https://github.com/NativePHP/desktop/issues">
+                    desktop
+                </a>
+                issue trackers are where most reports go. Include as much detail
+                as you can:
+            </p>
+
+            <ul>
+                <li>A clear, descriptive title.</li>
+                <li>Steps to reproduce the issue.</li>
+                <li>What you expected to happen and what actually happened.</li>
+                <li>
+                    Your environment: OS, PHP version, Laravel version and
+                    NativePHP version.
+                </li>
+            </ul>
+
+            <p>
+                Questions and ideas for improvements are welcome as issues too.
+            </p>
+
+            <h2>Security vulnerabilities</h2>
+
+            <p>
+                Please
+                <strong>don't</strong>
+                open a public issue for a security vulnerability. See our
+                <a href="{{ route('security') }}">security policy</a>
+                for how to report it privately.
+            </p>
+
+            <h2>License</h2>
+
+            <p>
+                By contributing, you agree that your contributions will be
+                licensed under the same license as the repository you're
+                contributing to.
+            </p>
+
+            <h2>Code of Conduct</h2>
+
+            <p>
+                The NativePHP community is dedicated to providing a welcoming
+                and inclusive experience for everyone. We expect all
+                participants to follow these standards.
+            </p>
+
+            <h3>Our pledge</h3>
+
+            <p>
+                We as members, contributors, and leaders pledge to make
+                participation in our community a harassment-free experience for
+                everyone, regardless of age, body size, visible or invisible
+                disability, ethnicity, sex characteristics, gender identity and
+                expression, level of experience, education, socio-economic
+                status, nationality, personal appearance, race, caste, color,
+                religion, or sexual identity and orientation.
+            </p>
+
+            <p>
+                We pledge to act and interact in ways that contribute to an
+                open, welcoming, diverse, inclusive, and healthy community.
+            </p>
+
+            <h3>Our standards</h3>
+
+            <p>
+                Examples of behavior that contributes to a positive environment:
+            </p>
+
+            <ul>
+                <li>Using welcoming and inclusive language</li>
+                <li>
+                    Being respectful of differing viewpoints and experiences
+                </li>
+                <li>Gracefully accepting constructive criticism</li>
+                <li>Focusing on what is best for the community</li>
+                <li>Showing empathy towards other community members</li>
+            </ul>
+
+            <p>Examples of unacceptable behavior:</p>
+
+            <ul>
+                <li>
+                    The use of sexualized language or imagery, and sexual
+                    attention or advances of any kind
+                </li>
+                <li>
+                    Trolling, insulting or derogatory comments, and personal or
+                    political attacks
+                </li>
+                <li>Public or private harassment</li>
+                <li>
+                    Publishing others' private information without explicit
+                    permission
+                </li>
+                <li>
+                    Other conduct which could reasonably be considered
+                    inappropriate in a professional setting
+                </li>
+            </ul>
+
+            <h3>Enforcement</h3>
+
+            <p>
+                Instances of abusive, harassing, or otherwise unacceptable
+                behavior may be reported to the project team at
+                <a href="mailto:support@nativephp.com">support@nativephp.com</a>
+                and will be reviewed and investigated promptly and fairly.
+            </p>
+
+            <p>
+                Project maintainers who do not follow or enforce the Code of
+                Conduct in good faith may face temporary or permanent
+                repercussions as determined by other members of the project's
+                leadership.
+            </p>
+
+            <p>
+                The
+                <a
+                    href="https://www.contributor-covenant.org/version/2/1/code_of_conduct/"
+                >
+                    Contributor Covenant
+                </a>
+                version 2.1 is the basis for this Code of Conduct.
+            </p>
+
+            <h2>Thank you</h2>
+
+            <p>
+                Contributors play a big part in making NativePHP what it is.
+                Once your pull request is merged, you'll show up in the
+                repository's list of contributors on GitHub.
+            </p>
+        </article>
+    </section>
+</x-layout>
diff --git a/resources/views/security.blade.php b/resources/views/security.blade.php
new file mode 100644
index 00000000..93e68811
--- /dev/null
+++ b/resources/views/security.blade.php
@@ -0,0 +1,197 @@
+<x-layout title="Security">
+    {{-- Hero --}}
+    <section
+        class="mx-auto mt-10 w-full max-w-3xl md:mt-14"
+        aria-labelledby="article-title"
+    >
+        <header class="relative grid place-items-center text-center">
+            {{-- Blurred circle - Decorative --}}
+            <div
+                class="absolute top-0 right-1/2 -z-30 h-60 w-60 translate-x-1/2 rounded-full blur-[150px] md:w-80 dark:bg-slate-500/50"
+                aria-hidden="true"
+            ></div>
+
+            {{-- Primary Heading --}}
+            <h1
+                id="article-title"
+                x-init="
+                    () => {
+                        motion.inView($el, (element) => {
+                            motion.animate(
+                                $el,
+                                {
+                                    opacity: [0, 1],
+                                    x: [-5, 0],
+                                },
+                                {
+                                    duration: 0.7,
+                                    ease: motion.easeOut,
+                                },
+                            )
+                        })
+                    }
+                "
+                class="mt-8 text-3xl font-extrabold will-change-transform sm:text-4xl"
+            >
+                Security Policy
+            </h1>
+
+            {{-- Subtitle --}}
+            <p class="max-w-xl pt-4 text-gray-600 dark:text-gray-400">
+                How to report a security vulnerability in NativePHP, Bifrost or
+                a plugin.
+            </p>
+        </header>
+
+        {{-- Divider --}}
+        <x-divider />
+
+        {{-- Content --}}
+        <article
+            x-init="
+                () => {
+                    motion.inView($el, (element) => {
+                        motion.animate(
+                            $el,
+                            {
+                                opacity: [0, 1],
+                                y: [5, 0],
+                            },
+                            {
+                                duration: 0.7,
+                                ease: motion.easeOut,
+                            },
+                        )
+                    })
+                }
+            "
+            class="prose mt-2 max-w-none text-gray-600 will-change-transform dark:text-gray-400 dark:prose-headings:text-white"
+            aria-labelledby="article-title"
+        >
+            <div
+                class="not-prose rounded-xl border border-amber-200 bg-amber-50 p-4 text-amber-900 dark:border-amber-800 dark:bg-amber-950/30 dark:text-amber-200"
+                role="note"
+            >
+                <p class="font-semibold">
+                    Please don't disclose security issues publicly.
+                </p>
+                <p class="mt-1 text-sm">
+                    Don't open a public issue, pull request or discussion for a
+                    vulnerability. Report it privately using one of the options
+                    below.
+                </p>
+            </div>
+
+            <p>
+                All security vulnerabilities will be promptly addressed. Where
+                you report one depends on what it affects.
+            </p>
+
+            <h2>Open source packages</h2>
+
+            <p>
+                For NativePHP's open source packages, use GitHub's private
+                <strong>Report a vulnerability</strong>
+                form on the package's repository. Only the maintainers can see
+                what you send, and we can work on a fix with you there before
+                anything is made public.
+            </p>
+
+            @php
+                $packageGroups = [
+                    'Core' => [
+                        'nativephp/mobile' => 'mobile-air',
+                        'nativephp/desktop' => 'desktop',
+                    ],
+                    'Mobile plugins' => [
+                        'nativephp/mobile-browser' => 'mobile-browser',
+                        'nativephp/mobile-camera' => 'mobile-camera',
+                        'nativephp/mobile-clipboard' => 'mobile-clipboard',
+                        'nativephp/mobile-device' => 'mobile-device',
+                        'nativephp/mobile-dialog' => 'mobile-dialog',
+                        'nativephp/mobile-dynamic-notifications' => 'mobile-dynamic-notifications',
+                        'nativephp/mobile-file' => 'mobile-file',
+                        'nativephp/mobile-media-player' => 'mobile-media-player',
+                        'nativephp/mobile-microphone' => 'mobile-microphone',
+                        'nativephp/mobile-network' => 'mobile-network',
+                        'nativephp/mobile-ota' => 'mobile-ota',
+                        'nativephp/mobile-share' => 'mobile-share',
+                        'nativephp/mobile-system' => 'mobile-system',
+                        'nativephp/mobile-ui' => 'mobile-ui',
+                        'nativephp/mobile-vibe' => 'mobile-vibe',
+                    ],
+                    'Tools and starter kits' => [
+                        'nativephp/php-bin' => 'php-bin',
+                        'nativephp/laravel-cloud-deploy' => 'laravel-cloud-deploy',
+                        'nativephp/web-ui' => 'web-ui',
+                        'nativephp/mobile-starter' => 'mobile-starter',
+                        'nativephp/superstack' => 'superstack',
+                    ],
+                ];
+            @endphp
+
+            @foreach ($packageGroups as $group => $packages)
+                <h3>{{ $group }}</h3>
+
+                <ul
+                    class="not-prose divide-y divide-gray-200 rounded-xl border border-gray-200 text-sm dark:divide-white/10 dark:border-white/10"
+                >
+                    @foreach ($packages as $package => $repository)
+                        <li
+                            class="flex flex-wrap items-center justify-between gap-x-4 gap-y-1 px-4 py-2.5"
+                        >
+                            <span
+                                class="font-mono text-gray-700 dark:text-gray-300"
+                            >
+                                {{ $package }}
+                            </span>
+                            <a
+                                href="https://github.com/NativePHP/{{ $repository }}/security/advisories/new"
+                                class="font-medium"
+                            >
+                                Report a vulnerability
+                            </a>
+                        </li>
+                    @endforeach
+                </ul>
+            @endforeach
+
+            <h2>Bifrost, this website and private plugins</h2>
+
+            <p>
+                Email
+                <a href="mailto:support@nativephp.com">support@nativephp.com</a>
+                about vulnerabilities in
+                <a href="https://bifrost.nativephp.com">Bifrost</a>
+                or nativephp.com, and in NativePHP's own plugins that aren't
+                open source.
+            </p>
+
+            <h2>Third-party plugins</h2>
+
+            <p>
+                Plugins made by other developers are maintained by their
+                authors, so report vulnerabilities in them to the author. Every
+                plugin's page in the
+                <a href="{{ route('plugins') }}">plugin directory</a>
+                lists its support contact.
+            </p>
+
+            <p>
+                If you can't reach the author, or you think a plugin is
+                malicious, use the report form on the plugin's page so the
+                NativePHP team can step in.
+            </p>
+
+            <h2>What to include</h2>
+
+            <ul>
+                <li>
+                    The package, service or plugin affected, and its version.
+                </li>
+                <li>A description of the vulnerability and its impact.</li>
+                <li>Steps to reproduce it, or a proof of concept.</li>
+            </ul>
+        </article>
+    </section>
+</x-layout>
diff --git a/routes/web.php b/routes/web.php
index 31872767..dc254c9c 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -231,6 +231,8 @@
 Route::view('privacy-policy', 'privacy-policy')->name('privacy-policy');
 Route::view('terms-of-service', 'terms-of-service')->name('terms-of-service');
 Route::view('developer-terms', 'developer-terms')->name('developer-terms');
+Route::view('contributing', 'contributing')->name('contributing');
+Route::view('security', 'security')->name('security');
 Route::view('partners', 'partners')->name('partners');
 Route::view('partners/always-curious', 'partners.always-curious')->name('partners.always-curious');
 Route::view('build-my-app', 'build-my-app')->name('build-my-app');
diff --git a/tests/Feature/ContributingAndSecurityPagesTest.php b/tests/Feature/ContributingAndSecurityPagesTest.php
new file mode 100644
index 00000000..1ea0de1a
--- /dev/null
+++ b/tests/Feature/ContributingAndSecurityPagesTest.php
@@ -0,0 +1,140 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Features\ShowAuthButtons;
+use App\Features\ShowPlugins;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Pennant\Feature;
+use PHPUnit\Framework\Attributes\Test;
+use Tests\TestCase;
+
+class ContributingAndSecurityPagesTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Feature::define(ShowAuthButtons::class, false);
+        Feature::define(ShowPlugins::class, true);
+    }
+
+    #[Test]
+    public function the_contributing_page_covers_the_workflow_guidelines_and_code_of_conduct(): void
+    {
+        $this
+            ->withoutVite()
+            ->get('/contributing')
+            ->assertOk()
+            ->assertSee('<title>Contributing - NativePHP</title>', false)
+            ->assertSeeInOrder([
+                'Contributing to NativePHP',
+                'Where to contribute',
+                'How to contribute',
+                'Pull request guidelines',
+                'Code style and tests',
+                'Reporting bugs',
+                'Security vulnerabilities',
+                'License',
+                'Code of Conduct',
+            ]);
+    }
+
+    #[Test]
+    public function the_contributing_page_links_to_each_repository_and_the_security_policy(): void
+    {
+        $this
+            ->withoutVite()
+            ->get('/contributing')
+            ->assertOk()
+            ->assertSee('https://github.com/NativePHP/mobile-air', false)
+            ->assertSee('https://github.com/NativePHP/desktop', false)
+            ->assertSee('https://github.com/NativePHP/nativephp.com', false)
+            ->assertSee('<a href="'.route('security').'">security policy</a>', false);
+    }
+
+    #[Test]
+    public function the_security_page_links_to_the_github_vulnerability_form_for_every_public_package(): void
+    {
+        $repositories = [
+            'mobile-air',
+            'desktop',
+            'mobile-browser',
+            'mobile-camera',
+            'mobile-clipboard',
+            'mobile-device',
+            'mobile-dialog',
+            'mobile-dynamic-notifications',
+            'mobile-file',
+            'mobile-media-player',
+            'mobile-microphone',
+            'mobile-network',
+            'mobile-ota',
+            'mobile-share',
+            'mobile-system',
+            'mobile-ui',
+            'mobile-vibe',
+            'php-bin',
+            'laravel-cloud-deploy',
+            'web-ui',
+            'mobile-starter',
+            'superstack',
+        ];
+
+        $response = $this
+            ->withoutVite()
+            ->get('/security')
+            ->assertOk()
+            ->assertSee('<title>Security - NativePHP</title>', false)
+            ->assertSee('Security Policy');
+
+        foreach ($repositories as $repository) {
+            $response->assertSee("https://github.com/NativePHP/{$repository}/security/advisories/new", false);
+        }
+
+        $this->assertSame(
+            count($repositories),
+            substr_count($response->getContent(), '/security/advisories/new'),
+        );
+    }
+
+    #[Test]
+    public function the_security_page_points_the_core_mobile_package_at_its_actual_repository(): void
+    {
+        $this
+            ->withoutVite()
+            ->get('/security')
+            ->assertOk()
+            ->assertSee('nativephp/mobile')
+            ->assertSee('https://github.com/NativePHP/mobile-air/security/advisories/new', false)
+            ->assertDontSee('https://github.com/NativePHP/mobile/security/advisories/new', false);
+    }
+
+    #[Test]
+    public function the_security_page_sends_private_services_to_support_and_third_party_plugins_to_their_authors(): void
+    {
+        $this
+            ->withoutVite()
+            ->get('/security')
+            ->assertOk()
+            ->assertSeeInOrder([
+                'Bifrost, this website and private plugins',
+                'mailto:support@nativephp.com',
+                'Third-party plugins',
+                '<a href="'.route('plugins').'">plugin directory</a>',
+            ], false);
+    }
+
+    #[Test]
+    public function the_footer_links_to_the_contributing_and_security_pages(): void
+    {
+        $this
+            ->withoutVite()
+            ->get('/privacy-policy')
+            ->assertOk()
+            ->assertSee('href="'.route('contributing').'"', false)
+            ->assertSee('href="'.route('security').'"', false);
+    }
+}