diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..26a54fe
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,46 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "security"
+
+  - package-ecosystem: "npm"
+    directory: "/apps/web"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "security"
+
+  - package-ecosystem: "npm"
+    directory: "/packages/core"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "security"
+
+  - package-ecosystem: "npm"
+    directory: "/packages/db"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "security"
+
+  - package-ecosystem: "npm"
+    directory: "/apps/worker"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "security"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..210c9fe
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,42 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+  pull_request:
+    branches:
+      - main
+      - develop
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - javascript-typescript
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 4f67d5f..3ad53ca 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -106,9 +106,33 @@ jobs:
               --body-file "$BODY_FILE"
           else
             echo "Creating new release PR"
-            gh pr create \
-              --base main \
-              --head develop \
-              --title "$PR_TITLE" \
-              --body-file "$BODY_FILE"
+            set +e
+            CREATE_OUTPUT="$(
+              gh pr create \
+                --base main \
+                --head develop \
+                --title "$PR_TITLE" \
+                --body-file "$BODY_FILE" 2>&1
+            )"
+            CREATE_EXIT=$?
+            set -e
+
+            if [ "$CREATE_EXIT" -eq 0 ]; then
+              echo "$CREATE_OUTPUT"
+              exit 0
+            fi
+
+            if echo "$CREATE_OUTPUT" | grep -q "No commits between main and develop"; then
+              echo "No commits between main and develop. Skipping PR creation."
+              exit 0
+            fi
+
+            if echo "$CREATE_OUTPUT" | grep -q "Resource not accessible by integration"; then
+              echo "::warning::Unable to create release PR with GitHub Actions token. Add RELEASE_PR_TOKEN secret (PAT with repo scope) to enable automatic creation."
+              echo "$CREATE_OUTPUT"
+              exit 0
+            fi
+
+            echo "$CREATE_OUTPUT"
+            exit "$CREATE_EXIT"
           fi
diff --git a/.release-please-manifest.develop.json b/.release-please-manifest.develop.json
index daf284a..9635e74 100644
--- a/.release-please-manifest.develop.json
+++ b/.release-please-manifest.develop.json
@@ -1,5 +1,5 @@
 {
-  ".": "0.1.0-alpha.22",
+  ".": "0.1.0-alpha.23",
   "apps/web": "0.1.0-alpha.21",
   "apps/worker": "0.1.0-alpha.3"
 }
diff --git a/CHANGELOG-DEVELOP.md b/CHANGELOG-DEVELOP.md
index d824f3b..381048c 100644
--- a/CHANGELOG-DEVELOP.md
+++ b/CHANGELOG-DEVELOP.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.1.0-alpha.23](https://github.com/devakone/vibe-coding-profiler/compare/vibe-coding-profiler-v0.1.0-alpha.22...vibe-coding-profiler-v0.1.0-alpha.23) (2026-02-15)
+
+
+### Bug Fixes
+
+* **ci:** handle release PR create permission fallback ([310e6ec](https://github.com/devakone/vibe-coding-profiler/commit/310e6ec23b0d34181a4a75c14dfb07625e6a8e43))
+
 ## [0.1.0-alpha.22](https://github.com/devakone/vibe-coding-profiler/compare/vibe-coding-profiler-v0.1.0-alpha.21...vibe-coding-profiler-v0.1.0-alpha.22) (2026-02-12)
 
 
diff --git a/apps/web/src/app/api/share-debug/route.tsx b/apps/web/src/app/api/share-debug/route.tsx
deleted file mode 100644
index 2ff09aa..0000000
--- a/apps/web/src/app/api/share-debug/route.tsx
+++ /dev/null
@@ -1,42 +0,0 @@
-import { ImageResponse } from "next/og";
-
-export const runtime = "nodejs";
-
-export async function GET(request: Request) {
-  const url = new URL(request.url);
-  const test = url.searchParams.get("test") || "basic";
-
-  try {
-    if (test === "basic") {
-      return new Response("Debug route works", { status: 200 });
-    }
-
-    if (test === "image") {
-      return new ImageResponse(
-        (
-          <div
-            style={{
-              width: "100%",
-              height: "100%",
-              display: "flex",
-              alignItems: "center",
-              justifyContent: "center",
-              background: "linear-gradient(135deg, #667eea 0%, #764ba2 100%)",
-              color: "white",
-              fontSize: 48,
-            }}
-          >
-            ImageResponse Works!
-          </div>
-        ),
-        { width: 600, height: 400 }
-      );
-    }
-
-    return new Response(`Unknown test: ${test}`, { status: 400 });
-  } catch (e: unknown) {
-    const message = e instanceof Error ? e.message : "Unknown error";
-    console.error("Debug route error:", e);
-    return new Response(`Error: ${message}`, { status: 500 });
-  }
-}