diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index b0309b9..56f5a2e 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -18,16 +18,60 @@ Instead, use GitHub's private vulnerability reporting:
 3. Click "Report a vulnerability"
 4. Fill in the details
 
-Or email: security@barazo.forum (TBD - will be set up in Phase 2)
+Or email: security@barazo.forum
 
 We will respond within 72 hours with next steps.
 
+## Security Scope for This Repo
+
+barazo-web is the Next.js frontend -- it renders user-generated content, handles client-side OAuth flows, and communicates with the API. The following areas are in scope for security reports:
+
+### Cross-Site Scripting (XSS)
+
+- **Stored XSS** -- user-generated content (topics, replies, profiles) rendering unsanitized HTML
+- **Reflected XSS** -- URL parameters or search queries reflected in page output without escaping
+- **DOM-based XSS** -- client-side JavaScript constructing DOM from untrusted data
+- **Markdown rendering** -- malicious markdown/HTML bypassing the sanitization pipeline
+
+### Cross-Site Request Forgery (CSRF)
+
+- **State-changing actions** -- actions (create topic, react, report, moderate) that can be triggered by external sites
+- **OAuth state parameter** -- CSRF in the AT Protocol OAuth callback flow
+
+### Content Security Policy (CSP)
+
+- **CSP bypass** -- techniques to execute scripts or load resources that violate the Content Security Policy
+- **Inline script injection** -- circumventing CSP nonce or hash requirements
+- **External resource loading** -- loading unauthorized third-party scripts or styles
+
+### Authentication & Session
+
+- **OAuth token leakage** -- access tokens exposed in URLs, logs, or browser history
+- **Session fixation** -- reusing or injecting session identifiers
+- **Open redirect** -- OAuth callback or navigation URLs redirecting to external malicious sites
+
+### Information Disclosure
+
+- **Server-side rendering leaks** -- SSR exposing API keys, internal URLs, or admin data in HTML source
+- **Error messages** -- stack traces or internal paths exposed to users
+- **SEO metadata injection** -- manipulating JSON-LD, OpenGraph, or sitemap output with user-controlled data
+
+### Client-Side Security
+
+- **Local storage/cookie exposure** -- sensitive data stored insecurely in the browser
+- **Clickjacking** -- missing or bypassable frame-busting (X-Frame-Options / frame-ancestors)
+- **Prototype pollution** -- client-side prototype pollution via URL parameters or user input
+
 ## Security Practices
 
-- All commits must be GPG signed
+- All user-generated content sanitized before rendering
+- Content Security Policy headers configured via Next.js
+- HTTPS-only (enforced by Caddy reverse proxy with HSTS)
+- No inline scripts or eval (CSP-compatible)
+- eslint-plugin-jsx-a11y in strict mode (catches some security-adjacent issues)
+- No secret values in client-side bundles (`NEXT_PUBLIC_` prefix convention)
 - Dependencies updated weekly via Dependabot
-- CI runs security scans on every PR
-- OWASP Top 10 compliance verified
+- CodeQL security scanning on every PR
 
 ## Disclosure Policy