diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..b2b08fe
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,52 @@
+version: 2
+updates:
+  # Go backend dependencies
+  - package-ecosystem: "gomod"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "go"
+    commit-message:
+      prefix: "deps(go)"
+    # Group indirect/security updates to reduce PR noise.
+    groups:
+      indirect:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Frontend npm dependencies
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "npm"
+    commit-message:
+      prefix: "deps(npm)"
+    groups:
+      minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions versions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "ci"
+    commit-message:
+      prefix: "deps(ci)"
diff --git a/.gitignore b/.gitignore
index 76a9eb6..bb7422b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,9 +1,20 @@
-
-frontend-variants/
+# Dependencies
 node_modules/
-*.log
-
 frontend-variants/
 
+# Build / generated
+*.log
+
 # Python helper bytecode
 __pycache__/
+
+# Secrets & local state — never commit these.
+.env
+.env.*
+*.db
+*.db-*
+*.key
+*.pem
+*.crt
+*.csr
+backend/data/