diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..35be2b1
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,17 @@
+# Changelog
+
+## 0.1.0
+
+First release.
+
+- Look up any Solana program ID and see which loader owns it: native, BPF Loader v1 or v2, or the Upgradeable BPF Loader. Loader v4 is recognized but not read yet
+- For upgradeable programs: the upgrade authority, the slot and date of the last deploy, and the program size
+- A plain-English verdict on the first line: upgradeable, frozen, immutable, built-in, closed or unknown
+- `--json` prints one JSON object on stdout, safe to pipe to `jq`, with `canUpgrade` for scripts
+- Only small slices of each account are requested (36 and 45 bytes), so lookups are cheap even for programs with megabytes of code
+- Closed programs are reported as closed, and a missing deploy date (a pruned block) does not hide the rest of the result
+- Requests retry with backoff on rate limits, server errors and network errors, and a `Retry-After` header is respected
+- A rejected API key (HTTP 401 or 403) or a wrong URL (HTTP 404) stops at once with a plain-English message
+- Only the endpoint hostname is ever printed, so API keys never reach your terminal
+- Exit codes: `0` success, `1` invalid program ID or endpoint setting, `2` bad usage, `3` RPC lookup failed, `4` not a program
+- Zero dependencies, Node 18 or newer
\ No newline at end of file
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..c71b014
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,53 @@
+# Contributing
+
+Thanks for helping out. This is a small zero-dependency CLI, so the process is short.
+
+## Setup
+
+You need Node 18 or newer.
+
+```bash
+git clone https://github.com/switch-afk/sol-program-info.git
+cd sol-program-info
+npm test
+```
+
+There is nothing to install: the tool has no dependencies. Tests use the built-in `node --test` runner.
+
+Tests never touch the network. The RPC is replaced with a fake `fetch` from `tests/helpers/mock-rpc.js`, so the whole suite runs offline. Use that helper for any new test that needs an RPC answer.
+
+## Trying it against a real program
+
+Set your own RPC endpoint first. Public RPCs rate-limit heavily.
+
+```bash
+export SOL_PROGRAM_INFO_RPC="https://your-rpc-endpoint"
+node bin/sol-program-info.js <program-id>
+```
+
+Never paste an RPC URL with a key into an issue or a pull request. The tool only prints the hostname for this reason, so keep it that way.
+
+## Making a change
+
+1. Open an issue first for anything bigger than a small fix, so we agree on the idea.
+2. Create a branch from `main`.
+3. Keep the change focused: one feature or fix per pull request.
+4. Add or update tests. New behavior without a test will be asked for one.
+5. Update the README if behavior or output changes, and add a line under the next version in `CHANGELOG.md`.
+6. Open the pull request and wait for the Tests check to pass on Node 18, 20 and 22.
+
+## Code style
+
+- Plain CommonJS, no build step, and no new dependencies unless there is a strong reason.
+- Error messages are written for people. Say what went wrong and what to do about it.
+- Error messages, output and logs must never include the full endpoint URL.
+- Be honest about what the tool cannot tell. An address that cannot be read is reported as unknown, never guessed.
+
+## Ideas that would help
+
+- Support for Loader v4 accounts
+- Tests against more unusual account layouts
+
+## Reporting a bug
+
+Please include your Node version, the program ID, the command you ran, and the status messages from stderr. Use the endpoint hostname only, never the full URL.
\ No newline at end of file
diff --git a/package.json b/package.json
index 33d8b7f..6a8bdbf 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "sol-program-info",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "description": "Check if a Solana program is upgradeable, who controls it, and when it was last deployed.",
   "bin": {
     "sol-program-info": "bin/sol-program-info.js"
@@ -22,6 +22,7 @@
     "program",
     "upgrade-authority",
     "security",
+    "audit",
     "cli",
     "web3"
   ],