@@ -26,12 +26,33 @@ This is a public repository, so **never leave the personal instance address in d
 
 ---
 
+## Branch model
+
+```
+feature branch ──PR──> dev ──release PR──> main
+```
+
+| Branch | Role |
+|---|---|
+| `dev` | Default branch. Integration target. **Every contributor PR goes here.** |
+| `main` | Releases only. Updated through a separate reviewed `dev` → `main` release PR. |
+
+Rules:
+
+- Branch from `dev`, open the PR into `dev`.
+- Never commit directly to `dev` or `main`.
+- Never open a PR against `main`. Promoting `dev` to `main` is a maintainer decision and gets its
+  own reviewed release PR.
+- Rebase or merge `dev` into your branch to resolve conflicts. Do not rewrite published history.
+
+---
+
 ## Overall Flow
 
 ```
 Create Issue
    ↓
-Create branch (branched from main)
+Create branch (branched from dev)
    ↓
 Commit (with Signed-off-by)
    ↓
@@ -46,7 +67,7 @@ CI passes + Review
 Merge  ← done by a maintainer
 ```
 
-Never commit or push directly to `main`.
+Never commit or push directly to `dev` or `main`.
 
 ---
 
@@ -70,14 +91,21 @@ gh issue view 12
 
 ### Labels
 
-| Label | Purpose |
+Structured prefixes so filters stay useful as the tracker grows.
+
+| Prefix | Labels |
 |---|---|
-| `feat` `fix` `docs` `refactor` `test` `chore` | Type of change |
-| `M0` `M1` `M2` `M3` `M4` | Milestone |
-| `android` `ios` `desktop` | Platform-specific issues |
-| `api` `ui` `design-system` | Area |
-| `self-hosted` | Self-hosted GitLab-only problems |
-| `good first issue` | For new contributors |
+| type | `feat` `fix` `docs` `refactor` `test` `chore` |
+| area | `area:api` `area:ui` `area:design-system` `area:ci` `area:docs` `area:mobile` `area:desktop` `area:security` |
+| milestone | `M0` `M1` `M2` `M3` `M4` |
+| platform | `platform:android` `platform:ios` `platform:windows` `platform:macos` |
+| priority | `priority:critical` `priority:high` `priority:medium` `priority:low` |
+| size | `size:XS` `size:S` `size:M` `size:L` `size:XL` |
+| status | `status:needs-triage` `status:in-progress` `status:blocked` |
+| special | `self-hosted` `good first issue` `help wanted` `question` `duplicate` `invalid` |
+
+`self-hosted` marks problems that only reproduce against a self-managed GitLab instance.
+Those are hard for maintainers to reproduce, so they need extra detail from the reporter.
 
 ---
 
@@ -99,11 +127,11 @@ chore/35-melos-bootstrap
 - The slug is lowercase + hyphens. Keep it short.
 
 ```
-git switch main && git pull
+git switch dev && git pull
 git switch -c feat/12-mr-diff-viewer
 ```
 
-**Always branch from the latest `main`.** Don't stack on top of another working branch.
+**Always branch from the latest `dev`.** Don't stack on top of another working branch.
 If a dependency is unavoidable, state the prerequisite PR in the PR description.
 
 ---
@@ -157,13 +185,13 @@ flutter test
 
 ```
 git push -u origin feat/12-mr-diff-viewer
-gh pr create --fill --base main
+gh pr create --fill --base dev
 ```
 
 Start as a Draft:
 
 ```
-gh pr create --draft --fill --base main
+gh pr create --draft --fill --base dev
 gh pr ready 42
 ```
 
@@ -203,7 +231,8 @@ What agents may do without confirmation:
 
 **What they do not do:**
 
-- ❌ Push directly to `main`
+- ❌ Push directly to `dev` or `main`
+- ❌ Open a PR against `main` (release promotion is a maintainer decision)
 - ❌ Force push (both `--force` and `--force-with-lease`)
 - ❌ **Merge PRs** — a maintainer does that
 - ❌ Delete Issues / PRs / branches
 
@@ -0,0 +1,136 @@
+name: Bug report
+description: Report something in LabFox that does not work as expected
+title: "fix: "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## ⚠️ Read this before you paste anything
+
+        LabFox talks to GitLab with **Personal Access Tokens (`glpat-...`)**, OAuth access/refresh
+        tokens, and often against **self-hosted instances on private hostnames**. Job logs, diffs and
+        API responses copied out of the app frequently contain secrets and employer-confidential code.
+
+        **Never paste into this issue:**
+
+        - Tokens of any kind (`glpat-...`, OAuth access/refresh tokens, CI job tokens, cookies)
+        - `Authorization`, `Private-Token` or `Job-Token` headers
+        - Self-hosted instance hostnames, internal URLs, IP addresses or project paths
+        - Private or employer-confidential source code, diffs or raw job logs
+        - Exploit details or proof-of-concept material
+
+        **Redact before pasting.** Replace secrets with `<REDACTED>` and hostnames with
+        `gitlab.example.com`. A public issue cannot be un-published.
+
+        🔒 If you think you found a **security vulnerability**, do **not** open an issue here.
+        Follow [SECURITY.md](https://github.com/labfox-app/labfox/blob/dev/SECURITY.md) instead.
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: Describe the observed behavior. What did LabFox actually do?
+      placeholder: |
+        Opening a merge request from the to-do inbox shows an empty diff pane instead of the file list.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Give the minimal numbered steps someone else can follow to see the same result.
+      placeholder: |
+        1. Sign in to gitlab.example.com with a PAT
+        2. Open the to-do inbox
+        3. Tap a merge request entry
+        4. Observe the diff pane
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What did you expect to happen instead?
+      placeholder: |
+        The diff pane should list the changed files and render the unified diff.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      description: Where did you see this? Open one issue per platform if it differs.
+      options:
+        - Android
+        - iOS
+        - Windows
+        - macOS
+    validations:
+      required: true
+
+  - type: dropdown
+    id: instance-type
+    attributes:
+      label: GitLab instance type
+      description: Which kind of GitLab instance were you connected to?
+      options:
+        - GitLab.com
+        - Self-hosted (GitLab CE)
+        - Self-hosted (GitLab EE)
+    validations:
+      required: true
+
+  - type: input
+    id: gitlab-version
+    attributes:
+      label: GitLab version
+      description: >-
+        Version of the GitLab instance, if you know it. Leave this empty if the version itself is
+        sensitive information for your organization. Do not enter the hostname here.
+      placeholder: "17.4.1"
+    validations:
+      required: false
+
+  - type: input
+    id: labfox-version
+    attributes:
+      label: LabFox version or commit SHA
+      description: >-
+        The app version you are running, or the commit SHA you built from. LabFox is
+        pre-scaffolding, so a commit SHA is expected for now.
+      placeholder: "0.1.0 or a1b2c3d"
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs and screenshots
+      description: >-
+        Optional. Stack traces, redacted job logs or screenshots that help. ⚠️ Redact first —
+        strip every token, `Authorization` header, instance hostname, internal URL and any
+        confidential source code. Blur the same things out of screenshots.
+      placeholder: |
+        [ERROR] GET https://gitlab.example.com/api/v4/projects/<REDACTED>/merge_requests/12/changes -> 401
+        Authorization: Bearer <REDACTED>
+      render: shell
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: confirmation
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched the existing issues and this is not a duplicate.
+          required: true
+        - label: >-
+            I removed every token, `Authorization` header, instance hostname, internal URL,
+            credential and confidential piece of data from this report.
+          required: true
+        - label: This report is written in English.
+          required: true
@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security reports
+    url: https://github.com/labfox-app/labfox/blob/dev/SECURITY.md
+    about: >-
+      Report vulnerabilities privately. Never publish tokens, instance hostnames, or exploit
+      material in a public issue.
+  - name: Support and setup
+    url: https://github.com/labfox-app/labfox/blob/dev/SUPPORT.md
+    about: >-
+      Questions about installing, signing in, or connecting to a self-hosted GitLab instance.
@@ -0,0 +1,105 @@
+name: Feature request
+description: Suggest a capability that strengthens the core LabFox review flow
+title: "feat: "
+labels: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## ⚠️ Read this before you paste anything
+
+        Do **not** include tokens (`glpat-...`, OAuth access/refresh tokens), `Authorization` or
+        `Private-Token` headers, self-hosted instance hostnames, internal URLs, private or
+        employer-confidential source code, or exploit details. **Redact before pasting** —
+        use `<REDACTED>` and `gitlab.example.com`.
+
+        🔒 Security vulnerabilities do not belong in a public issue. Follow
+        [SECURITY.md](https://github.com/labfox-app/labfox/blob/dev/SECURITY.md) instead.
+
+  - type: markdown
+    attributes:
+      value: |
+        ## What LabFox is trying to be
+
+        LabFox deliberately does **not** port every GitLab web feature. It is a focused client for
+        one core flow:
+
+        ```
+        check notifications → review Issue/MR → read diff and review
+        → check pipeline status → read job log → Approve / Merge / Retry
+        ```
+
+        A request is far more likely to be accepted when it makes a step of that flow faster,
+        clearer or possible on a phone.
+
+        ### Explicitly out of 1.0 scope
+
+        Requests for the following will be **closed**:
+
+        Wiki · Packages · Container Registry · Infrastructure · Kubernetes ·
+        Security Dashboard · Analytics · Admin Area · Runner Administration · AI features
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve
+      description: >-
+        Describe the problem, not the solution. What are you doing today, and where does it break
+        down or slow you down?
+      placeholder: |
+        When a pipeline fails I cannot tell which job failed without leaving the MR screen, so on
+        mobile I end up opening the GitLab web UI anyway.
+    validations:
+      required: true
+
+  - type: textarea
+    id: core-flow
+    attributes:
+      label: How does this fit the core flow
+      description: >-
+        Which step of "notifications → review Issue/MR → diff and review → pipeline status →
+        job log → Approve/Merge/Retry" does this serve, and how?
+      placeholder: |
+        It shortens the "check pipeline status → read job log" step: the failing job becomes
+        reachable in one tap from the MR screen instead of three.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Optional. If you already have a concrete idea, sketch it here.
+      placeholder: |
+        Show a compact pipeline strip on the MR screen with the failing job highlighted and tappable.
+    validations:
+      required: false
+
+  - type: dropdown
+    id: platforms
+    attributes:
+      label: Which platforms does this matter for
+      description: Optional. Select every platform where this would make a difference.
+      multiple: true
+      options:
+        - Android
+        - iOS
+        - Windows
+        - macOS
+        - All
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: confirmation
+    attributes:
+      label: Before submitting
+      options:
+        - label: >-
+            I read the 1.0 scope above, my request is not in the out-of-scope list, and I searched
+            the existing issues for a duplicate.
+          required: true
+        - label: >-
+            This request is written in English and contains no tokens, instance hostnames or
+            confidential data.
+          required: true