diff --git a/.oss-scanner/Dockerfile b/.oss-scanner/Dockerfile
new file mode 100644
index 0000000..d139b54
--- /dev/null
+++ b/.oss-scanner/Dockerfile
@@ -0,0 +1,28 @@
+# Builds Ely for Anthropic's OSS Scanner: the library and its tests, all crates fetched while online.
+FROM debian:bookworm
+ENV DEBIAN_FRONTEND=noninteractive \
+    RUSTUP_HOME=/usr/local/rustup \
+    CARGO_HOME=/usr/local/cargo \
+    PATH=/usr/local/cargo/bin:$PATH \
+    CARGO_NET_OFFLINE=false
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates curl build-essential clang cmake pkg-config git python3 \
+      libfontconfig-dev libfreetype-dev libxkbcommon-dev libxkbcommon-x11-dev \
+      libwayland-dev libx11-dev libx11-xcb-dev libxcb1-dev libxi-dev libxcursor-dev libxrandr-dev \
+      libvulkan-dev libasound2-dev libssl-dev libzstd-dev \
+    && rm -rf /var/lib/apt/lists/*
+RUN curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.95
+
+# Tests check file permissions, which root ignores, so the build runs as a plain user.
+RUN useradd --create-home ely
+COPY --chown=ely:ely . /src
+RUN chown -R ely:ely /usr/local/cargo /usr/local/rustup
+USER ely
+WORKDIR /src
+
+# Fetch every crate, then build the library and its tests with debug info; tests run offline later.
+RUN cargo fetch --locked
+RUN cargo build --locked --lib --features test-support \
+    && cargo test --locked --lib --features test-support --no-run
+ENV CARGO_NET_OFFLINE=true
+RUN cargo test --locked --lib --features test-support --quiet || echo "WARNING: cargo test reported failures"
diff --git a/.oss-scanner/threat_model.md b/.oss-scanner/threat_model.md
new file mode 100644
index 0000000..a598a6e
--- /dev/null
+++ b/.oss-scanner/threat_model.md
@@ -0,0 +1,25 @@
+# Threat model
+
+## What this project does and where untrusted input enters
+Ely is a Rust component library for GPUI desktop and web apps. It runs inside the host app's process, so the host decides what is trusted. Treat as untrusted whatever an app's users or the network can hand a component:
+- Markdown rendered by `documents` (pulldown-cmark) and text typed or pasted into fields (`forms::TextInput`, `editor::CodeEditor`).
+- JSON and settings parsed with serde: saved layouts (`layout::workspace`), JSON editors and viewers (`devtools`), imported VS Code settings and themes (`settings::vscode`, `editor::settings`), GeoJSON (`maps::geojson`, `maps::choropleth`).
+- Pictures decoded with `image` and QR frames read with `rqrr` (`media`, `misc::QrCodeScanner`).
+- Terminal output and ANSI escape codes (`terminal`, `typography` `AnsiText` via vte).
+- File names and paths from drops, archives and folder listings (`forms::files`, `files`, `lists::Folder::of`).
+
+## Components that matter most / least
+- Most: parsers and anything that turns external bytes into layout (markdown, JSON/GeoJSON, ANSI, images, QR, archive paths), and the few `unsafe` blocks that call AppKit (`shell::native`, `buttons::share`, `forms::color::dropper`).
+- Less: pure drawing and theme code. `examples/`, `frontend/` (the website), `compat/` and `scripts/` are out of scope.
+
+## How to exercise it
+`cargo test --lib --features test-support` runs the suite headless on gpui's test platform. Parsers can be driven directly from unit tests.
+
+## How you rate severity
+- Memory unsafety in an `unsafe` block, or a path traversal that reaches outside a chosen folder: high.
+- A panic, unbounded allocation or hang reachable from untrusted input: medium (it takes down the host app).
+- Wrong rendering with no security effect: out of scope.
+
+## Anything to leave alone
+- Panics from asserts on a caller's own arguments are by design (fail fast). Report only panics reachable from runtime data.
+- The macOS-only code (AppKit, wry WebView) does not build in this Linux image.