diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index 69a472a..acfe5c6 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,28 +1,50 @@
 ---
 name: Bug report
-about: Something behaves wrong
+about: Something cprof does wrong
+title: ''
 labels: bug
+assignees: ''
 ---
 
-**What happened**
+<!-- Security problems go through GitHub private vulnerability reporting, not a
+     public issue — see SECURITY.md. -->
 
-**What you expected**
+## Environment
 
-**Reproduce**
+- **cprof version:** <!-- `cprof version` -->
+- **Install method:** <!-- brew / install.sh / plugin only -->
+- **Plugin installed:** <!-- `env -u CLAUDE_CONFIG_DIR claude plugin list` -->
+- **macOS version:**
+- **bash version:** <!-- `/bin/bash --version | head -1` -->
+- **jq version:** <!-- `jq --version` -->
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Expected behavior
+
+<!-- What you expected to happen -->
+
+## Actual behavior
+
+<!-- What actually happened -->
+
+## Diagnostics
+
+<!-- `cprof status` shows the resolution, the config path and the active
+     profile; `cprof doctor` adds login state, usage windows, statusline
+     config problems and version skew. Both are safe to paste. -->
 
 ```console
 $ cprof status
-# paste output — it shows resolution, config path, and active profile
+
+$ cprof doctor
+
 ```
 
-**Environment**
-- macOS version:
-- `bash --version` (first line):
-- `cprof version`:
-- Install method: brew / downloaded installer (install.sh) / plugin
-
-**Notes**
-`cprof status` and `cprof list` output never contains credentials, but check
-before pasting anyway. Never paste keychain output or config JSON containing
-tokens. Security issues go to [private reporting](../../security/advisories/new),
-not here.
+<!-- Before pasting anything else: `status`, `list` and `doctor` never print
+     credentials, but keychain output and a config file can contain tokens.
+     Do not paste those. -->
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..f6ebf8e
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/dcotelo/cprof/security/advisories/new
+    about: cprof handles credentials and the macOS keychain. Report vulnerabilities through GitHub private vulnerability reporting — see SECURITY.md. Do not open a public issue.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
index 4cf766a..957f879 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -1,13 +1,27 @@
 ---
 name: Feature request
 about: Something cprof should do
+title: ''
 labels: enhancement
+assignees: ''
 ---
 
-**Problem**
-What you are trying to do and where cprof gets in the way.
+## Problem
 
-**Proposed behavior**
+<!-- What you are trying to do, and where cprof gets in the way today. -->
 
-**Alternatives considered**
-Including why the existing commands (`pin`, `rule`, `default`, `env`) don't cover it.
+## Proposed behavior
+
+<!-- What should happen instead. Concrete output beats a description: show the
+     line you want a command to print, or the config you want to write. -->
+
+## Alternatives considered
+
+<!-- Including why the existing commands don't cover it — `pin`, `rule`,
+     `default`, `env`, `usage`, `fallback`, `statusline`, `doctor`. -->
+
+## Additional context
+
+<!-- Anything that helps: which surface this touches (CLI, statusline, plugin
+     hooks, installer), links, and whether it needs to work without `git` or
+     without network. -->
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 09621cc..79f3b84 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,9 +1,66 @@
-## What
+## Summary
 
-## Why
+<!-- What does this PR change, and why? -->
 
-## Testing
+## Type
 
-- [ ] `bash tests/run.sh` passes
-- [ ] `shellcheck -x -P scripts -P tests scripts/cprof scripts/lib/*.sh hooks/*.sh statusline/*.sh tests/*.sh .github/scripts/*.sh docs/demo/*.sh docs/demo/bin/* install.sh` is clean
-- [ ] New behavior carries an assertion in `tests/`
+<!-- These are load-bearing, not tidy: CI reads the commit subjects to decide
+     whether merging publishes a release, and at what version. `feat:` is a
+     minor, `fix:`/`perf:` a patch, `!` a major; `docs:`, `chore:`, `test:`,
+     `ci:` and `refactor:` publish nothing. -->
+
+- [ ] feat
+- [ ] fix
+- [ ] perf
+- [ ] docs
+- [ ] test
+- [ ] chore
+- [ ] ci
+- [ ] refactor
+
+## Surface(s) touched
+
+- [ ] CLI (`scripts/cprof`, `scripts/lib/*.sh`)
+- [ ] statusline (`scripts/lib/statusline.sh`, `statusline/segment.sh`)
+- [ ] plugin (`hooks/`, `commands/`, manifests)
+- [ ] installer (`install.sh`)
+- [ ] docs (`README.md`, `docs/`, `CONTRIBUTING.md`)
+- [ ] CI and release automation (`.github/`)
+
+## Test evidence
+
+<!-- The commands you ran and what they reported, e.g.:
+     bash tests/run.sh            -> ALL TESTS PASSED, 1130 assertions
+     shellcheck -x ...            -> clean
+     bash tests/test_manifest.sh  -> pass -->
+
+## Checklist
+
+- [ ] `bash tests/run.sh` passes, and CI is green.
+- [ ] shellcheck is clean over the file list CI uses
+      (`.github/workflows/ci.yml`; a new script must be added to it).
+- [ ] New behavior carries an assertion in `tests/`.
+- [ ] **My tests can FAIL**: I can name the single change to the code that
+      each new or changed assertion would catch, and I have watched it fail.
+      An assertion that passes whether or not the code works has tested
+      nothing — this has been caught here more than once.
+- [ ] **bash 3.2**: no associative arrays, no `${var,,}`, nothing newer than
+      the macOS system shell. `cut -d. -f<n>` without `-s` prints the whole
+      line when the delimiter is absent; prefer `IFS=. read -r -a`.
+- [ ] Conventional Commits subject on every commit, matching the Type above.
+- [ ] Every commit carries a DCO sign-off (`git commit -s`).
+- [ ] No AI attribution anywhere in the commits or this PR (no "Generated
+      with", no `Co-authored-by:` trailers for an AI tool or agent).
+- [ ] Docs updated if this changes user-facing behavior, output or commands —
+      including the topic doc under `docs/`, not only the README.
+- [ ] User-facing output follows the conventions: diagnostics to stderr via
+      `cp_warn`, `cprof env` stdout reserved for shell-eval output, paths
+      through `cp_path_display`.
+- [ ] Nothing that renders inside a Claude Code session can fail it: a missing
+      `jq`, an unreadable config, an absent `git` or a missing CLI prints
+      nothing, or as much as it can, and exits 0.
+- [ ] **Breaking changes declared**: if this changes a published contract — a
+      `~/.cprof.json` key, a `statusline` segment or setting name, a
+      subcommand or flag, the shape of `cprof env` output, or a cache path —
+      the summary says so explicitly and gives the upgrade note. Write "None"
+      if there are none.