diff --git a/.fallowrc.json b/.fallowrc.json
new file mode 100644
index 0000000..116f517
--- /dev/null
+++ b/.fallowrc.json
@@ -0,0 +1,14 @@
+{
+  "$schema": "https://raw.githubusercontent.com/fallow-rs/fallow/main/schema.json",
+  "entry": ["src/index.{js,jsx,mjs}", "src/main.{js,jsx,mjs}"],
+  "workspaces": {
+    "packages": ["apps/*", "packages/*"]
+  },
+  "duplicates": {
+    "minOccurrences": 3,
+    "minLines": 5,
+    "mode": "semantic",
+    "ignore": ["**/lib/**", "**/legacy/**", "**/__generated__/**", "**/generated/**"]
+  },
+  "rules": {}
+}
diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 99e936d..2c02343 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -38,3 +38,11 @@ jobs:
 
       - name: Typecheck
         run: pnpm check-types
+
+      - name: Audit security (dependencies)
+        run: pnpm audit --audit-level=moderate
+
+      - name: Analyze codebase health (technical debt)
+        uses: fallow-rs/fallow@v2
+        with:
+          format: sarif
diff --git a/.gitignore b/.gitignore
index 4bd21d4..113aada 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,4 @@ yarn-error.log*
 # Misc
 .DS_Store
 *.pem
+.fallow/
diff --git a/apps/api/src/main.ts b/apps/api/src/main.ts
index 65481f7..1962fc9 100644
--- a/apps/api/src/main.ts
+++ b/apps/api/src/main.ts
@@ -1,8 +1,11 @@
 import { NestFactory } from "@nestjs/core";
 import { AppModule } from "./app.module";
 
+const DEFAULT_PORT = 3001;
+
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
-  await app.listen(process.env.PORT ?? 3001);
+  await app.listen(process.env.PORT ?? DEFAULT_PORT);
 }
+// eslint-disable-next-line @typescript-eslint/no-floating-promises
 bootstrap();