diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml
new file mode 100644
index 0000000..1d72668
--- /dev/null
+++ b/.github/workflows/deny.yml
@@ -0,0 +1,30 @@
+# Supply-chain audit: runs `cargo deny check` against the RustSec advisory
+# database plus the license / bans / sources policy in `deny.toml`. The crate's
+# whole job is to make network calls, so a vulnerable transitive dependency is
+# a real risk worth catching in CI.
+#
+# Triggers on push to main and on every PR, matching rust.yml. Also runs on
+# changes to deny.toml itself and weekly, so newly-published advisories against
+# already-pinned dependencies surface even without a code change.
+
+name: cargo-deny
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  cargo-deny:
+    name: cargo-deny
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check advisories bans licenses sources
diff --git a/.github/workflows/semver.yml b/.github/workflows/semver.yml
new file mode 100644
index 0000000..2993290
--- /dev/null
+++ b/.github/workflows/semver.yml
@@ -0,0 +1,34 @@
+# Guards against accidental SemVer violations: cargo-semver-checks diffs the
+# crate's public API against a baseline and fails if the change (added /
+# removed / altered items) is larger than the version bump allows. The crate
+# went 0.3.3 -> 0.12.0 with no mechanical check that the bumps matched the API
+# changes; this adds one.
+#
+# The crate is distributed via git (not published to crates.io), so there is no
+# registry baseline to diff against. Instead we diff each PR's public API
+# against the PR's base commit via `baseline-rev`; `fetch-depth: 0` makes that
+# commit available in the checkout. The action derives the expected bump from
+# the version in Cargo.toml.
+#
+# PR-only: the check is about reviewing an API change before it merges.
+
+name: semver-checks
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  semver-checks:
+    name: semver-checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: obi1kenobi/cargo-semver-checks-action@v2
+        with:
+          baseline-rev: ${{ github.event.pull_request.base.sha }}
+          feature-group: all-features
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..88bbdbf
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,51 @@
+# cargo-deny configuration — supply-chain checks for the datamaxi crate.
+# Run locally with `cargo deny check`; enforced in CI (.github/workflows/deny.yml).
+# Schema targets cargo-deny 0.16+ (the version cargo-deny-action@v2 ships).
+
+# ── Security advisories ──────────────────────────────────────────────────────
+# Checks dependencies against the RustSec advisory database. In cargo-deny
+# 0.16+ vulnerabilities / unmaintained / unsound / notice always error unless
+# explicitly listed in `ignore`, so there are no per-severity knobs here.
+[advisories]
+db-urls = ["https://github.com/rustsec/advisory-db"]
+# Refuse yanked crates.
+yanked = "deny"
+# Advisory IDs to ignore, with a justification comment each. Keep empty.
+ignore = []
+
+# ── Licenses ─────────────────────────────────────────────────────────────────
+# Allow-list of SPDX identifiers. This set covers every license currently in
+# the dependency tree (all permissive / weak-copyleft). A new dependency under
+# a license not listed here fails CI on purpose — add it deliberately.
+[licenses]
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Unicode-3.0",
+    "Zlib",
+    "BSL-1.0",
+    "MPL-2.0",
+    "CDLA-Permissive-2.0",
+]
+confidence-threshold = 0.8
+exceptions = []
+
+# ── Banned / duplicate crates ────────────────────────────────────────────────
+[bans]
+# Duplicate versions of a crate are common in transitive trees and shouldn't
+# fail the build; surface them as warnings instead.
+multiple-versions = "warn"
+# No dependency should use a `*` version requirement.
+wildcards = "deny"
+allow = []
+deny = []
+
+# ── Sources ──────────────────────────────────────────────────────────────────
+# Every dependency must come from crates.io; no unknown registries or git deps.
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
diff --git a/src/lib.rs b/src/lib.rs
index 774b40f..01cf1ac 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,4 +1,6 @@
 #![cfg_attr(docsrs, feature(doc_cfg))]
+#![forbid(unsafe_code)]
+#![warn(missing_docs)]
 //! # DataMaxi+ Rust SDK
 //!
 //! This is the official implementation of Rust SDK for [DataMaxi+](https://datamaxiplus.com/).
@@ -91,7 +93,7 @@ pub mod api;
 // compatibility. The lint allows reflect the generator's unconditional imports
 // and its `new()`-only option constructors.
 #[doc(hidden)]
-#[allow(unused_imports, clippy::new_without_default)]
+#[allow(unused_imports, clippy::new_without_default, missing_docs)]
 pub mod generated;
 
 /// Typed wrappers for every REST endpoint on the data API — the canonical