diff --git a/.husky/pre-commit b/.husky/pre-commit
index f8b9c80a5..a3cb5805d 100644
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1,4 +1,4 @@
 npx lint-staged
 cd src-tauri && cargo fmt && git add -u .
 cd "$(git rev-parse --show-toplevel)/crates/dbx-core" && cargo fmt --all && git add -u .
-cd "$(git rev-parse --show-toplevel)/src-web" && cargo fmt && git add -u .
\ No newline at end of file
+cd "$(git rev-parse --show-toplevel)/crates/dbx-web" && cargo fmt && git add -u .
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 000000000..43273ef66
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,71 @@
+# Contributing to DBX
+
+Thanks for helping improve DBX. This repository contains the desktop app, Rust backend, Docker service, documentation site, CLI, MCP server, and optional plugins.
+
+## Project Layout
+
+- `apps/desktop/` - Vue desktop frontend.
+- `crates/dbx-core/` - shared Rust database core.
+- `crates/dbx-web/` - Docker/web backend service.
+- `src-tauri/` - Tauri desktop shell and native commands.
+- `packages/` - Node packages, including CLI, MCP server, shared Node core, and app tests.
+- `plugins/` - optional DBX plugins.
+- `docs/` - documentation site and docs assets.
+- `deploy/` - Docker and deployment assets.
+
+## Development Setup
+
+Required tools:
+
+- Node.js `>=22.13.0`
+- pnpm `10.27.0`
+- Rust stable
+- Java 17, when working on JDBC plugin packaging
+
+Install dependencies:
+
+```bash
+pnpm install
+```
+
+Run the desktop app during development:
+
+```bash
+pnpm dev:tauri
+```
+
+Run the web backend:
+
+```bash
+pnpm dev:backend
+```
+
+## Checks
+
+Before opening a pull request, run:
+
+```bash
+pnpm check
+cargo fmt --check
+cargo check --workspace --locked
+```
+
+For package changes, also run:
+
+```bash
+pnpm test:packages
+pnpm publish:dry-run
+```
+
+For Docker or deployment changes, run the relevant Docker Compose or Docker build checks from `deploy/`.
+
+## Pull Requests
+
+- Keep changes focused and reviewable.
+- Include tests for behavior changes when practical.
+- Update documentation when user-facing behavior changes.
+- Use clear commit messages following Conventional Commits, such as `fix(app): clamp window size`.
+
+## Reporting Issues
+
+Use GitHub Issues for reproducible bugs, feature requests, database compatibility reports, and questions. Include the DBX version, operating system, database type, and relevant logs or screenshots when possible.
diff --git a/Cargo.toml b/Cargo.toml
index 390ef8ef7..52072b2d7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [workspace]
 resolver = "2"
-members = ["src-tauri", "crates/dbx-core", "src-web"]
+members = ["src-tauri", "crates/dbx-core", "crates/dbx-web"]
 
 [profile.release]
 panic = "abort"
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..31abe6da3
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,30 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please do not report security vulnerabilities in public GitHub issues.
+
+Use GitHub's private vulnerability reporting for this repository when available. If that is not available to you, open a minimal GitHub issue asking for a private security contact without including exploit details, credentials, tokens, connection strings, database dumps, or screenshots containing secrets.
+
+## What to Include
+
+Helpful reports include:
+
+- Affected DBX version or commit.
+- Operating system and installation method.
+- The impacted component, such as desktop app, Docker service, CLI, MCP server, or JDBC plugin.
+- Steps to reproduce in a safe test environment.
+- Impact assessment and any known workaround.
+
+## Scope
+
+Security-sensitive areas include:
+
+- Connection storage, config import/export, and encryption.
+- Database credential handling.
+- SSH tunnel and proxy handling.
+- AI provider keys and OpenAI-compatible endpoint configuration.
+- MCP and CLI access to local DBX connections.
+- Docker web service authentication and data directory handling.
+
+Please avoid testing against systems you do not own or have explicit permission to assess.
diff --git a/src-web/Cargo.toml b/crates/dbx-web/Cargo.toml
similarity index 93%
rename from src-web/Cargo.toml
rename to crates/dbx-web/Cargo.toml
index 4b145d77a..4969b9b10 100644
--- a/src-web/Cargo.toml
+++ b/crates/dbx-web/Cargo.toml
@@ -8,7 +8,7 @@ name = "dbx-web"
 path = "src/main.rs"
 
 [dependencies]
-dbx-core = { path = "../crates/dbx-core" }
+dbx-core = { path = "../dbx-core" }
 axum = { version = "0.8", features = ["multipart"] }
 tower-http = { version = "0.6", features = ["cors", "fs", "compression-gzip", "trace"] }
 tokio = { version = "1", features = ["full"] }
diff --git a/src-web/src/auth.rs b/crates/dbx-web/src/auth.rs
similarity index 100%
rename from src-web/src/auth.rs
rename to crates/dbx-web/src/auth.rs
diff --git a/src-web/src/error.rs b/crates/dbx-web/src/error.rs
similarity index 100%
rename from src-web/src/error.rs
rename to crates/dbx-web/src/error.rs
diff --git a/src-web/src/main.rs b/crates/dbx-web/src/main.rs
similarity index 100%
rename from src-web/src/main.rs
rename to crates/dbx-web/src/main.rs
diff --git a/src-web/src/routes/ai.rs b/crates/dbx-web/src/routes/ai.rs
similarity index 100%
rename from src-web/src/routes/ai.rs
rename to crates/dbx-web/src/routes/ai.rs
diff --git a/src-web/src/routes/connection.rs b/crates/dbx-web/src/routes/connection.rs
similarity index 100%
rename from src-web/src/routes/connection.rs
rename to crates/dbx-web/src/routes/connection.rs
diff --git a/src-web/src/routes/database_export.rs b/crates/dbx-web/src/routes/database_export.rs
similarity index 100%
rename from src-web/src/routes/database_export.rs
rename to crates/dbx-web/src/routes/database_export.rs
diff --git a/src-web/src/routes/history.rs b/crates/dbx-web/src/routes/history.rs
similarity index 100%
rename from src-web/src/routes/history.rs
rename to crates/dbx-web/src/routes/history.rs
diff --git a/src-web/src/routes/layout.rs b/crates/dbx-web/src/routes/layout.rs
similarity index 100%
rename from src-web/src/routes/layout.rs
rename to crates/dbx-web/src/routes/layout.rs
diff --git a/src-web/src/routes/mod.rs b/crates/dbx-web/src/routes/mod.rs
similarity index 100%
rename from src-web/src/routes/mod.rs
rename to crates/dbx-web/src/routes/mod.rs
diff --git a/src-web/src/routes/mongo.rs b/crates/dbx-web/src/routes/mongo.rs
similarity index 100%
rename from src-web/src/routes/mongo.rs
rename to crates/dbx-web/src/routes/mongo.rs
diff --git a/src-web/src/routes/plugins.rs b/crates/dbx-web/src/routes/plugins.rs
similarity index 100%
rename from src-web/src/routes/plugins.rs
rename to crates/dbx-web/src/routes/plugins.rs
diff --git a/src-web/src/routes/query.rs b/crates/dbx-web/src/routes/query.rs
similarity index 100%
rename from src-web/src/routes/query.rs
rename to crates/dbx-web/src/routes/query.rs
diff --git a/src-web/src/routes/redis.rs b/crates/dbx-web/src/routes/redis.rs
similarity index 100%
rename from src-web/src/routes/redis.rs
rename to crates/dbx-web/src/routes/redis.rs
diff --git a/src-web/src/routes/saved_sql.rs b/crates/dbx-web/src/routes/saved_sql.rs
similarity index 100%
rename from src-web/src/routes/saved_sql.rs
rename to crates/dbx-web/src/routes/saved_sql.rs
diff --git a/src-web/src/routes/schema.rs b/crates/dbx-web/src/routes/schema.rs
similarity index 100%
rename from src-web/src/routes/schema.rs
rename to crates/dbx-web/src/routes/schema.rs
diff --git a/src-web/src/routes/schema_cache.rs b/crates/dbx-web/src/routes/schema_cache.rs
similarity index 100%
rename from src-web/src/routes/schema_cache.rs
rename to crates/dbx-web/src/routes/schema_cache.rs
diff --git a/src-web/src/routes/sql_file.rs b/crates/dbx-web/src/routes/sql_file.rs
similarity index 100%
rename from src-web/src/routes/sql_file.rs
rename to crates/dbx-web/src/routes/sql_file.rs
diff --git a/src-web/src/routes/table_import.rs b/crates/dbx-web/src/routes/table_import.rs
similarity index 100%
rename from src-web/src/routes/table_import.rs
rename to crates/dbx-web/src/routes/table_import.rs
diff --git a/src-web/src/routes/transfer.rs b/crates/dbx-web/src/routes/transfer.rs
similarity index 100%
rename from src-web/src/routes/transfer.rs
rename to crates/dbx-web/src/routes/transfer.rs
diff --git a/src-web/src/routes/update.rs b/crates/dbx-web/src/routes/update.rs
similarity index 100%
rename from src-web/src/routes/update.rs
rename to crates/dbx-web/src/routes/update.rs
diff --git a/src-web/src/sse.rs b/crates/dbx-web/src/sse.rs
similarity index 100%
rename from src-web/src/sse.rs
rename to crates/dbx-web/src/sse.rs
diff --git a/src-web/src/state.rs b/crates/dbx-web/src/state.rs
similarity index 100%
rename from src-web/src/state.rs
rename to crates/dbx-web/src/state.rs
diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index 7cc9e2ee1..9253a0d98 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -34,10 +34,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # This layer is cached by GHA as long as Cargo.toml/Cargo.lock don't change.
 COPY Cargo.toml Cargo.lock ./
 COPY crates/dbx-core/Cargo.toml crates/dbx-core/
-COPY src-web/Cargo.toml src-web/
+COPY crates/dbx-web/Cargo.toml crates/dbx-web/
 COPY src-tauri/Cargo.toml src-tauri/
 RUN mkdir -p crates/dbx-core/src && echo '' > crates/dbx-core/src/lib.rs \
-    && mkdir -p src-web/src && echo 'fn main() {}' > src-web/src/main.rs \
+    && mkdir -p crates/dbx-web/src && echo 'fn main() {}' > crates/dbx-web/src/main.rs \
     && mkdir -p src-tauri/src && echo 'fn main() {}' > src-tauri/src/main.rs && echo 'pub fn run() {}' > src-tauri/src/lib.rs
 
 COPY src-tauri/build.rs src-tauri/
@@ -56,12 +56,11 @@ RUN case "$TARGETARCH" in \
 
 # Copy real sources and rebuild (only application code recompiles)
 COPY crates/ crates/
-COPY src-web/ src-web/
 
 # Docker COPY preserves original file timestamps, which may be older than the
 # dummy-source binary compiled above. Touch all .rs files so cargo detects the
 # source change and recompiles instead of reusing the dummy binary.
-RUN find crates/ src-web/ -name '*.rs' -exec touch {} +
+RUN find crates/ -name '*.rs' -exec touch {} +
 
 RUN case "$TARGETARCH" in \
       amd64) rust_target=x86_64-unknown-linux-gnu; lib_arch=x86_64-linux-gnu ;; \