diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index 04c9544..f80dd2d 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -10,6 +10,7 @@ env:
   SOLUTION_PATH: './Healthy/Healthy.sln'
   API_PROJECT_PATH: './Healthy/Healthy.Api/Healthy.Api.csproj'
   TEST_PROJECT_PATH: './Healthy/Healthy.Tests.Unit/Healthy.Tests.Unit.csproj'
+  INFRASTRUCTURE_PROJECT_PATH: './Healthy/Healthy.Infrastructure/Healthy.Infrastructure.csproj'
 
 jobs:
   changes:
diff --git a/.gitignore b/.gitignore
index cb88a93..5173f5a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -545,7 +545,6 @@ temp/
 
 # Docker
 .dockerignore
-Dockerfile
 docker-compose.yml
 docker-compose.override.yml
 
diff --git a/Healthy/Healthy.Api/Dockerfile b/Healthy/Healthy.Api/Dockerfile
new file mode 100644
index 0000000..2f74da1
--- /dev/null
+++ b/Healthy/Healthy.Api/Dockerfile
@@ -0,0 +1,54 @@
+# Build stage
+FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
+WORKDIR /src
+
+# Copy solution file and all project files for dependency resolution
+COPY ["Healthy.sln", "./"]
+COPY ["Healthy.Api/Healthy.Api.csproj", "Healthy.Api/"]
+COPY ["Healthy.Application/Healthy.Application.csproj", "Healthy.Application/"]
+COPY ["Healthy.Domain/Healthy.Domain.csproj", "Healthy.Domain/"]
+COPY ["Healthy.Infrastructure/Healthy.Infrastructure.csproj", "Healthy.Infrastructure/"]
+COPY ["Healthy.Tests.Unit/Healthy.Tests.Unit.csproj", "Healthy.Tests.Unit/"]
+
+# Restore dependencies
+RUN dotnet restore "Healthy.Api/Healthy.Api.csproj"
+
+# Copy source code
+COPY . .
+
+# Build the application
+WORKDIR "/src/Healthy.Api"
+RUN dotnet build "Healthy.Api.csproj" -c Release -o /app/build
+
+# Publish stage
+FROM build AS publish
+RUN dotnet publish "Healthy.Api.csproj" -c Release -o /app/publish /p:UseAppHost=false
+
+# Runtime stage
+FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS runtime
+WORKDIR /app
+
+# Create a non-root user for security
+RUN groupadd -r healthyuser && useradd --no-log-init -r -g healthyuser healthyuser
+
+# Copy published application
+COPY --from=publish /app/publish .
+
+# Set ownership to the non-root user
+RUN chown -R healthyuser:healthyuser /app
+USER healthyuser
+
+# Configure ports
+EXPOSE 8080
+EXPOSE 8081
+
+# Configure environment
+ENV ASPNETCORE_URLS=http://+:8080
+ENV ASPNETCORE_ENVIRONMENT=Production
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+    CMD curl -f http://localhost:8080/health || exit 1
+
+# Set the entry point
+ENTRYPOINT ["dotnet", "Healthy.Api.dll"]
\ No newline at end of file
diff --git a/Healthy/Healthy.Api/Program.cs b/Healthy/Healthy.Api/Program.cs
index 1b2ffc4..741eda9 100644
--- a/Healthy/Healthy.Api/Program.cs
+++ b/Healthy/Healthy.Api/Program.cs
@@ -11,6 +11,9 @@
 // Add services to the container
 builder.Services.AddControllers();
 
+// Add health checks
+builder.Services.AddHealthChecks();
+
 // Add custom CORS
 builder.Services.AddCustomCors(builder.Environment);
 
@@ -67,6 +70,9 @@
 
 app.MapControllers();
 
+// Add health check endpoint
+app.MapHealthChecks("/health");
+
 // Print startup information
 ApplicationExtensions.PrintStartupInfo(app.Environment);
 
diff --git a/README.md b/README.md
index b078552..d48f52b 100644
--- a/README.md
+++ b/README.md
@@ -143,13 +143,25 @@ healthy-system/
 
 ## 🔧 Development Workflow
 
+### 🛠️ Quick Start Scripts
+```bash
+# Setup development environment
+./scripts/setup-dev.sh
+
+# Validate CI/CD pipeline
+./scripts/validate-cicd.sh
+```
+
 ### 🛠️ Initial Setup (First Time)
 1. **Clone**: `git clone <repository-url>`
 2. **Navigate**: `cd healthy-system`
-3. **Environment**: Copy `.env.example` → `.env.development`
-4. **Database**: `docker-compose -f docker-compose.dev.yml up -d`
-5. **Migrate**: `dotnet ef database update --project Healthy.Infrastructure`
-6. **Run**: `cd Healthy && dotnet run --project Healthy.Api`
+3. **Run Setup**: `./scripts/setup-dev.sh` (automated setup)
+   
+   Or manual setup:
+4. **Environment**: Copy `.env.example` → `.env.development`
+5. **Database**: `docker-compose -f docker-compose.dev.yml up -d`
+6. **Migrate**: `dotnet ef database update --project Healthy.Infrastructure`
+7. **Run**: `cd Healthy && dotnet run --project Healthy.Api`
 
 ### � Daily Development
 1. **Pull latest**: `git pull origin main`
@@ -163,6 +175,15 @@ healthy-system/
 2. **Deploy**: `docker-compose -f docker-compose.prod.yml up -d`
 3. **Verify**: Check health endpoints and logs
 
+### 🤖 CI/CD Pipeline
+- **Automated Building**: .NET 9.0 with comprehensive testing
+- **Security Scanning**: SAST, dependency checks, container scanning
+- **Performance Testing**: Artillery load testing
+- **Multi-Environment**: Development and production deployments
+- **Quality Gates**: Code coverage, security, and performance thresholds
+
+For detailed CI/CD information, see [docs/CI-CD.md](docs/CI-CD.md)
+
 ---
 
 ## 🎯 Key Features & Capabilities
@@ -183,13 +204,16 @@ healthy-system/
 - 🔍 **Advanced Filtering** and pagination
 - � **RESTful API Design** with OpenAPI/Swagger
 
-### 🏗️ Technical Stack
+### 🔧 Technical Stack
 - ⚡ **Clean Architecture** with CQRS pattern
 - 🎯 **MediatR** for command/query handling  
 - 🗄️ **Entity Framework Core** with SQL Server
-- 🐳 **Docker** containerization
+- 🐳 **Docker** containerization with multi-stage builds
 - 🔄 **Database Migrations** with versioning
 - 🧪 **Unit Testing** with xUnit
+- 🚀 **CI/CD Pipeline** with GitHub Actions
+- 🛡️ **Security Scanning** with CodeQL, Snyk, and Trivy
+- ⚡ **Performance Testing** with Artillery
 
 ---
 
@@ -205,6 +229,9 @@ healthy-system/
 | **Migrations** | [README.Migrations.md](README.Migrations.md) | Database versioning & updates |
 | **Environment** | [README.Environment.md](README.Environment.md) | Configuration management |
 | **Docker** | [README.Docker.md](README.Docker.md) | Containerization & deployment |
+| **CI/CD Pipeline** | [docs/CI-CD.md](docs/CI-CD.md) | Complete CI/CD pipeline documentation |
+| **Performance Testing** | [performance-tests/README.md](performance-tests/README.md) | Load testing and performance monitoring |
+| **Security Policy** | [SECURITY.md](SECURITY.md) | Security guidelines and vulnerability reporting |
 
 ---
 
@@ -220,7 +247,9 @@ healthy-system/
 - **Documentation**: Start with relevant README files above
 - **Issues**: Create GitHub issue with detailed description
 - **Architecture Questions**: Refer to [README.Architecture.md](README.Architecture.md)
-- **Security Concerns**: See [README.Authorization.md](README.Authorization.md)
+- **Security Concerns**: See [README.Authorization.md](README.Authorization.md) and [SECURITY.md](SECURITY.md)
+- **CI/CD Help**: Check [docs/CI-CD.md](docs/CI-CD.md)
+- **Performance Issues**: See [performance-tests/README.md](performance-tests/README.md)
 
 ---
 
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..98cc755
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,177 @@
+# 🛡️ Security Policy
+
+## 📋 Supported Versions
+
+We actively maintain and provide security updates for the following versions:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.x.x   | ✅ Yes             |
+| < 1.0   | ❌ No              |
+
+## 🚨 Reporting a Vulnerability
+
+We take the security of the Healthy System seriously. If you believe you have found a security vulnerability, please report it to us as described below.
+
+### 📧 How to Report
+
+**Please do NOT report security vulnerabilities through public GitHub issues.**
+
+Instead, please send an email to: **security@healthysystem.com** (or create a private issue if this email is not available)
+
+Include the following information:
+- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
+- Full paths of source file(s) related to the manifestation of the issue
+- The location of the affected source code (tag/branch/commit or direct URL)
+- Any special configuration required to reproduce the issue
+- Step-by-step instructions to reproduce the issue
+- Proof-of-concept or exploit code (if possible)
+- Impact of the issue, including how an attacker might exploit the issue
+
+### 🔒 What to Expect
+
+You can expect the following process:
+
+1. **Acknowledgment**: We will acknowledge receipt of your report within 48 hours
+2. **Investigation**: We will investigate and validate the vulnerability within 7 days
+3. **Resolution**: We will work on a fix and aim to release it within 30 days for high/critical issues
+4. **Disclosure**: We will coordinate disclosure timing with you
+5. **Credit**: We will credit you in our security advisory (unless you prefer to remain anonymous)
+
+## 🛡️ Security Measures
+
+### Authentication & Authorization
+- JWT-based authentication with secure token generation
+- Role-based access control (RBAC)
+- Owner-based resource access validation
+- Password hashing using BCrypt
+
+### Data Protection
+- HTTPS/TLS encryption in transit
+- Secure database connections
+- Environment variable protection
+- Input validation and sanitization
+
+### Infrastructure Security
+- Container security scanning with Trivy
+- Dependency vulnerability scanning
+- Code analysis with CodeQL
+- Secrets scanning with TruffleHog
+
+### Development Security
+- Automated security scans in CI/CD pipeline
+- Dependency updates via Dependabot
+- Code review requirements
+- Branch protection rules
+
+## 🔍 Security Testing
+
+### Automated Scans
+- **SAST**: Static Application Security Testing with CodeQL
+- **Dependency Scanning**: Snyk and dotnet security audits
+- **Container Scanning**: Trivy vulnerability scanner
+- **Secrets Detection**: TruffleHog for exposed secrets
+- **License Compliance**: Package license validation
+
+### Manual Testing
+- Regular penetration testing
+- Code security reviews
+- Infrastructure assessments
+
+## 📋 Security Guidelines for Contributors
+
+### Code Security
+- Never commit secrets, passwords, or API keys
+- Use parameterized queries to prevent SQL injection
+- Implement proper input validation
+- Follow principle of least privilege
+- Use secure defaults
+
+### Dependencies
+- Keep dependencies up to date
+- Review dependency licenses
+- Avoid dependencies with known vulnerabilities
+- Use package lock files
+
+### Environment Security
+- Use environment variables for configuration
+- Separate development and production environments
+- Implement proper logging (without sensitive data)
+- Use secure communication channels
+
+## 🚫 Security Anti-Patterns to Avoid
+
+### ❌ Don't Do This
+- Hard-code secrets in source code
+- Use default passwords
+- Disable security features for convenience
+- Trust user input without validation
+- Store sensitive data in logs
+- Use HTTP in production
+- Commit `.env` files with real secrets
+
+### ✅ Do This Instead
+- Use secure secret management
+- Generate strong, unique passwords
+- Enable all security features
+- Validate and sanitize all inputs
+- Use structured logging without PII
+- Use HTTPS everywhere
+- Use `.env.example` with placeholder values
+
+## 🔧 Security Configuration
+
+### Environment Variables
+Ensure these security-related environment variables are properly configured:
+
+```bash
+# JWT Configuration
+JWT_SECRET_KEY=<strong-random-key>
+JWT_ISSUER=HealthySystem
+JWT_AUDIENCE=HealthySystemUsers
+JWT_EXPIRY_MINUTES=60
+
+# Database Security
+DB_CONNECTION_STRING=<encrypted-connection>
+DB_PASSWORD=<strong-password>
+
+# Application Security
+ASPNETCORE_ENVIRONMENT=Production
+ASPNETCORE_HTTPS_PORT=443
+```
+
+### Recommended Security Headers
+The application should implement these security headers:
+
+```
+Strict-Transport-Security: max-age=31536000; includeSubDomains
+Content-Security-Policy: default-src 'self'
+X-Content-Type-Options: nosniff
+X-Frame-Options: DENY
+X-XSS-Protection: 1; mode=block
+Referrer-Policy: strict-origin-when-cross-origin
+```
+
+## 📚 Security Resources
+
+### Documentation
+- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
+- [.NET Security Guidelines](https://docs.microsoft.com/en-us/dotnet/standard/security/)
+- [ASP.NET Core Security](https://docs.microsoft.com/en-us/aspnet/core/security/)
+
+### Tools Used
+- [CodeQL](https://codeql.github.com/)
+- [Snyk](https://snyk.io/)
+- [Trivy](https://trivy.dev/)
+- [TruffleHog](https://trufflesecurity.com/)
+
+## 📞 Contact
+
+For security-related questions or concerns:
+- Email: security@healthysystem.com
+- Security Team: @security-team
+- Documentation: [Security Documentation](./README.md#security--authentication)
+
+## 📄 License
+
+This security policy is licensed under the same terms as the main project.
\ No newline at end of file
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 97e0d2d..ab5f90f 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -1,7 +1,10 @@
-version: '3.8'
-
 services:
   healthy-api:
+    build:
+      context: ./Healthy
+      dockerfile: Healthy.Api/Dockerfile
+      target: runtime
+    image: ghcr.io/phuong-practice-projects/healthy-system/healthy-api:latest
     environment:
       - ASPNETCORE_ENVIRONMENT=Production
       - ASPNETCORE_URLS=http://+:8080
@@ -10,6 +13,9 @@ services:
     volumes: []
     # Only expose internal port
     ports: []
+    depends_on:
+      - healthy-db
+    restart: unless-stopped
     deploy:
       replicas: 2
       resources:
@@ -21,12 +27,16 @@ services:
           memory: 256M
 
   healthy-db:
+    image: mcr.microsoft.com/mssql/server:2022-latest
     environment:
       SA_PASSWORD: "${DB_PASSWORD}"
       ACCEPT_EULA: "Y"
       MSSQL_PID: "Standard"
     # Don't expose DB port externally in production
     ports: []
+    volumes:
+      - healthy-db-data:/var/opt/mssql
+    restart: unless-stopped
     deploy:
       resources:
         limits:
@@ -37,9 +47,16 @@ services:
           memory: 1G
 
   healthy-nginx:
+    image: nginx:alpine
     ports:
       - "80:80"
       - "443:443"
+    volumes:
+      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./nginx/ssl:/etc/nginx/ssl:ro
+    depends_on:
+      - healthy-api
+    restart: unless-stopped
     deploy:
       resources:
         limits:
@@ -48,3 +65,6 @@ services:
         reservations:
           cpus: '0.25'
           memory: 128M
+
+volumes:
+  healthy-db-data:
diff --git a/docs/CI-CD.md b/docs/CI-CD.md
new file mode 100644
index 0000000..13ff3ab
--- /dev/null
+++ b/docs/CI-CD.md
@@ -0,0 +1,306 @@
+# 🚀 CI/CD Pipeline Documentation
+
+## 📋 Overview
+
+The Healthy System employs a comprehensive CI/CD pipeline using GitHub Actions that includes:
+
+- **Continuous Integration**: Automated building, testing, and validation
+- **Continuous Deployment**: Automated deployment to development and production environments
+- **Security Scanning**: Automated vulnerability detection and dependency checks
+- **Performance Testing**: Load testing and performance monitoring
+- **Quality Assurance**: Code quality checks and coverage reporting
+
+## 🏗️ Pipeline Architecture
+
+### Workflow Files
+
+| Workflow | Purpose | Trigger |
+|----------|---------|---------|
+| `ci-cd.yml` | Main CI/CD pipeline | Push to main/develop, Manual dispatch |
+| `pr-validation.yml` | Pull request validation | PR opened/updated |
+| `security-scan.yml` | Security scanning | Schedule (weekly), Push to main/develop |
+| `release.yml` | Release management | Tags (v*.*.*), Manual dispatch |
+| `dependency-update.yml` | Dependency updates | Schedule (weekly), Manual dispatch |
+
+### Pipeline Stages
+
+```
+Code Changes → Change Detection → Build & Test → Docker Build → Deploy → Test → Monitor
+                                ↓               ↓
+                         Code Quality    Security Scan
+```
+
+## 🔄 Continuous Integration
+
+### Build Process
+1. **Environment Setup**: .NET 9.0 SDK installation
+2. **Dependency Caching**: NuGet package caching for faster builds
+3. **Restore**: Package dependency restoration
+4. **Build**: Solution compilation in Release mode
+5. **Test Database**: SQL Server container setup
+6. **Database Migration**: EF Core migration application
+7. **Unit Tests**: Comprehensive test execution with coverage
+8. **Coverage Reporting**: Test coverage analysis and reporting
+
+### Quality Gates
+- Build must succeed
+- All unit tests must pass
+- Code coverage thresholds (configurable)
+- Security scans must pass
+- No critical vulnerabilities in dependencies
+
+## 🐳 Containerization
+
+### Docker Strategy
+- **Multi-stage build** for optimized image size
+- **Non-root user** for security
+- **Health checks** for monitoring
+- **Multi-platform** support (AMD64, ARM64)
+
+### Image Lifecycle
+1. **Build**: Create optimized production image
+2. **Scan**: Trivy vulnerability scanning
+3. **Push**: GitHub Container Registry (ghcr.io)
+4. **Deploy**: Container orchestration
+5. **Monitor**: Health check validation
+
+## 🚀 Deployment Strategy
+
+### Environments
+
+#### Development Environment
+- **Trigger**: Push to `develop` branch
+- **Target**: Development infrastructure
+- **Features**: 
+  - Hot reload enabled
+  - Debug logging
+  - Test data seeding
+  - Performance testing
+
+#### Production Environment
+- **Trigger**: Push to `main` branch
+- **Target**: Production infrastructure
+- **Features**:
+  - Optimized performance
+  - Security hardening
+  - Database migrations
+  - Smoke testing
+
+### Deployment Process
+1. **Pre-deployment**: Environment validation
+2. **Database Migration**: Schema updates
+3. **Application Deployment**: Rolling deployment
+4. **Health Checks**: Service validation
+5. **Post-deployment**: Smoke tests
+
+## 🔒 Security Integration
+
+### Security Scanning
+- **SAST**: Static Application Security Testing (CodeQL)
+- **Dependency Scanning**: Vulnerability detection (Snyk)
+- **Container Scanning**: Image vulnerability scanning (Trivy)
+- **Secret Scanning**: Credential leak detection (TruffleHog)
+- **License Compliance**: Open source license validation
+
+### Security Gates
+- No high/critical vulnerabilities
+- All secrets properly configured
+- License compliance validated
+- Security policy adherence
+
+## ⚡ Performance Testing
+
+### Load Testing Strategy
+- **Framework**: Artillery.js
+- **Scenarios**: Realistic user workflows
+- **Metrics**: Response time, throughput, error rates
+- **Thresholds**: Performance regression detection
+
+### Test Scenarios
+1. **Health Checks**: Basic availability testing
+2. **Authentication**: Login/logout flows
+3. **CRUD Operations**: Data manipulation testing
+4. **Dashboard Access**: Read-heavy operations
+
+## 📊 Monitoring & Observability
+
+### Key Metrics
+- **Build Success Rate**: Pipeline reliability
+- **Test Coverage**: Code quality indicator
+- **Deployment Frequency**: Development velocity
+- **Lead Time**: Change deployment speed
+- **Mean Time to Recovery**: Incident response
+
+### Alerts & Notifications
+- Build failures
+- Security vulnerabilities
+- Performance degradation
+- Deployment failures
+
+## 🛠️ Development Workflow
+
+### Feature Development
+1. Create feature branch from `develop`
+2. Implement changes with tests
+3. Create pull request
+4. Automated validation runs
+5. Code review process
+6. Merge to `develop`
+7. Automated deployment to development
+
+### Release Process
+1. Create release branch from `develop`
+2. Version bump and changelog
+3. Create release tag
+4. Automated production deployment
+5. Release notes generation
+
+## 🔧 Configuration
+
+### Environment Variables
+
+#### Required Variables
+```bash
+# Database
+DB_PASSWORD=<strong-password>
+ConnectionStrings__DefaultConnection=<connection-string>
+
+# JWT
+JWT_SECRET_KEY=<secret-key>
+JWT_ISSUER=HealthySystem
+JWT_AUDIENCE=HealthySystemUsers
+
+# Application
+ASPNETCORE_ENVIRONMENT=<environment>
+```
+
+#### CI/CD Variables
+```bash
+# Container Registry
+REGISTRY=ghcr.io
+IMAGE_NAME=phuong-practice-projects/healthy-system/healthy-api
+
+# .NET Configuration
+DOTNET_VERSION=9.0.x
+
+# Performance Testing
+PERFORMANCE_TARGET_URL=<target-url>
+```
+
+### GitHub Secrets
+- `PRODUCTION_DB_PASSWORD`: Production database password
+- `SNYK_TOKEN`: Snyk API token for security scanning
+- `GITHUB_TOKEN`: Automatically provided by GitHub
+
+### GitHub Variables
+- `DEVELOPMENT_URL`: Development environment URL
+- `PRODUCTION_URL`: Production environment URL
+
+## 🚀 Getting Started
+
+### Prerequisites
+- GitHub repository with proper permissions
+- Container registry access
+- Target deployment infrastructure
+
+### Setup Steps
+1. **Fork/Clone**: Repository setup
+2. **Secrets Configuration**: Add required secrets
+3. **Environment Setup**: Configure variables
+4. **Infrastructure**: Prepare deployment targets
+5. **First Run**: Trigger initial pipeline
+
+### Local Development
+```bash
+# Start development environment
+docker-compose -f docker-compose.dev.yml up -d
+
+# Run the application
+cd Healthy
+dotnet run --project Healthy.Api
+
+# Run tests
+dotnet test
+
+# Performance testing
+cd performance-tests
+npm test
+```
+
+## 🐛 Troubleshooting
+
+### Common Issues
+
+#### Build Failures
+- Check .NET version compatibility
+- Verify package references
+- Review dependency conflicts
+
+#### Test Failures
+- Database connection issues
+- Missing test data
+- Environment configuration
+
+#### Deployment Issues
+- Container registry permissions
+- Target environment access
+- Configuration mismatches
+
+#### Performance Problems
+- Resource constraints
+- Database performance
+- Network latency
+
+### Debug Mode
+Enable verbose logging in workflows:
+```yaml
+- name: Debug Step
+  run: echo "ACTIONS_STEP_DEBUG=true" >> $GITHUB_ENV
+```
+
+## 📈 Optimization
+
+### Build Performance
+- Dependency caching
+- Parallel job execution
+- Incremental builds
+- Resource optimization
+
+### Deployment Efficiency
+- Blue-green deployments
+- Rolling updates
+- Health check optimization
+- Rollback strategies
+
+## 📚 Best Practices
+
+### Code Quality
+- Write comprehensive tests
+- Follow coding standards
+- Implement proper logging
+- Use dependency injection
+
+### Security
+- Regular security updates
+- Principle of least privilege
+- Secure secret management
+- Regular vulnerability scanning
+
+### Performance
+- Monitor key metrics
+- Set performance budgets
+- Regular load testing
+- Optimize bottlenecks
+
+### Maintenance
+- Regular dependency updates
+- Pipeline optimization
+- Documentation updates
+- Monitoring review
+
+## 📞 Support
+
+- **Documentation**: See individual README files
+- **Issues**: GitHub issue tracker
+- **Security**: See [SECURITY.md](../SECURITY.md)
+- **Performance**: See [performance-tests/README.md](../performance-tests/README.md)
\ No newline at end of file
diff --git a/performance-tests/README.md b/performance-tests/README.md
new file mode 100644
index 0000000..3ff5689
--- /dev/null
+++ b/performance-tests/README.md
@@ -0,0 +1,193 @@
+# 🚀 Performance Testing
+
+This directory contains performance testing infrastructure for the Healthy System API using [Artillery](https://artillery.io/).
+
+## 📋 Overview
+
+The performance testing suite includes:
+- **Load testing** with realistic user scenarios
+- **Stress testing** to find breaking points
+- **API endpoint validation** during load
+- **Response time monitoring**
+- **Automated reporting**
+
+## 🛠️ Setup
+
+### Prerequisites
+- Node.js 18+ installed
+- Healthy System API running (default: http://localhost:5001)
+- Valid test user accounts (see test data)
+
+### Installation
+```bash
+cd performance-tests
+npm install
+```
+
+Or install Artillery globally:
+```bash
+npm install -g artillery@latest
+```
+
+## 🎯 Test Scenarios
+
+### Current Test Scenarios
+1. **Health Check** (20% weight)
+   - Basic health endpoint validation
+   - Ensures API is responsive
+
+2. **User Authentication & Data Retrieval** (30% weight)
+   - Login with admin credentials
+   - Fetch users list
+   - Tests authentication flow
+
+3. **Body Record Creation** (25% weight)
+   - User login
+   - Create new body records
+   - Tests write operations
+
+4. **Dashboard Data** (25% weight)
+   - User login
+   - Fetch dashboard data
+   - Tests read-heavy operations
+
+## 🚀 Running Tests
+
+### Quick Health Check
+```bash
+npm run test:quick
+```
+
+### Full Load Test
+```bash
+npm run test
+```
+
+### Generate Report
+```bash
+npm run test:report
+```
+
+### Manual Artillery Commands
+```bash
+# Basic load test
+artillery run load-test.yml
+
+# With output for reporting
+artillery run load-test.yml --output results.json
+
+# Generate HTML report
+artillery report results.json --output report.html
+```
+
+## 📊 Test Configuration
+
+### Load Phases
+1. **Warm up**: 60s @ 10 requests/second
+2. **Load test**: 120s @ 50 requests/second  
+3. **Stress test**: 60s @ 100 requests/second
+
+### Expectations
+- Health endpoint: 200 status code
+- Authenticated endpoints: 200 status code
+- Create operations: 201 status code
+- Response times: Monitored and logged
+
+## 🔧 Customization
+
+### Updating Target URL
+Edit `load-test.yml`:
+```yaml
+config:
+  target: 'https://your-api-domain.com'
+```
+
+### Adding New Scenarios
+Add to the `scenarios` section in `load-test.yml`:
+```yaml
+- name: "Your New Scenario"
+  weight: 10
+  flow:
+    - get:
+        url: "/your-endpoint"
+        expect:
+          - statusCode: 200
+```
+
+### Test Data
+Update test credentials in `load-test.yml`:
+- Admin: `admin@healthysystem.com` / `Admin@123`
+- User: `user@healthysystem.com` / `User@123`
+
+## 📈 Results Analysis
+
+### Key Metrics
+- **Request rate**: Requests per second
+- **Response time**: p50, p95, p99 percentiles
+- **Error rate**: Failed requests percentage
+- **Concurrent users**: Simulated user load
+
+### Typical Thresholds
+- Response time p95: < 2000ms
+- Error rate: < 1%
+- Successful requests: > 99%
+
+## 🔄 CI/CD Integration
+
+Performance tests run automatically in the CI/CD pipeline:
+- Triggered after successful development deployment
+- Results uploaded as artifacts
+- Failure notifications for performance degradation
+
+### CI/CD Environment Variables
+- `PERFORMANCE_TARGET_URL`: Override default target URL
+- `PERFORMANCE_DURATION`: Override test duration
+- `PERFORMANCE_RATE`: Override request rate
+
+## 🛡️ Best Practices
+
+### Test Environment
+- Use dedicated test database
+- Ensure consistent test data
+- Monitor resource usage during tests
+- Clean up test data after runs
+
+### Performance Baselines
+- Establish baseline metrics for comparison
+- Track performance trends over time
+- Set alerts for regression detection
+- Document acceptable performance criteria
+
+## 🆘 Troubleshooting
+
+### Common Issues
+
+#### Connection Refused
+```
+ECONNREFUSED localhost:5001
+```
+**Solution**: Ensure the API is running on the correct port
+
+#### Authentication Failures
+```
+401 Unauthorized
+```
+**Solution**: Verify test user credentials and ensure users exist in test database
+
+#### High Error Rates
+```
+Error rate > 5%
+```
+**Solution**: Check API logs, database connections, and resource constraints
+
+### Debug Mode
+Run with verbose logging:
+```bash
+artillery run load-test.yml --verbose
+```
+
+## 📚 Additional Resources
+
+- [Artillery Documentation](https://artillery.io/docs/)
+- [Performance Testing Best Practices](https://artillery.io/docs/guides/overview/getting-started-with-performance-testing.html)
+- [Healthy System API Documentation](../README.md)
\ No newline at end of file
diff --git a/performance-tests/package.json b/performance-tests/package.json
new file mode 100644
index 0000000..2008a8d
--- /dev/null
+++ b/performance-tests/package.json
@@ -0,0 +1,19 @@
+{
+  "name": "healthy-system-performance-tests",
+  "version": "1.0.0",
+  "description": "Performance testing suite for Healthy System API",
+  "main": "load-test-functions.js",
+  "scripts": {
+    "test": "artillery run load-test.yml",
+    "test:quick": "artillery quick --count 10 --num 5 http://localhost:5001/health",
+    "test:report": "artillery run load-test.yml --output results.json && artillery report results.json",
+    "install-artillery": "npm install -g artillery@latest"
+  },
+  "dependencies": {
+    "artillery": "^2.0.0"
+  },
+  "devDependencies": {},
+  "keywords": ["performance", "testing", "api", "healthy-system"],
+  "author": "Healthy System Team",
+  "license": "MIT"
+}
\ No newline at end of file
diff --git a/scripts/setup-dev.sh b/scripts/setup-dev.sh
new file mode 100755
index 0000000..2a612bf
--- /dev/null
+++ b/scripts/setup-dev.sh
@@ -0,0 +1,190 @@
+#!/bin/bash
+
+# 🚀 Healthy System - Local Development Setup Script
+# This script sets up the local development environment
+
+set -e  # Exit on any error
+
+echo "🚀 Setting up Healthy System Development Environment..."
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Function to print colored output
+print_status() {
+    echo -e "${BLUE}[INFO]${NC} $1"
+}
+
+print_success() {
+    echo -e "${GREEN}[SUCCESS]${NC} $1"
+}
+
+print_warning() {
+    echo -e "${YELLOW}[WARNING]${NC} $1"
+}
+
+print_error() {
+    echo -e "${RED}[ERROR]${NC} $1"
+}
+
+# Check if running in correct directory
+if [ ! -f "Healthy/Healthy.sln" ]; then
+    print_error "Please run this script from the project root directory"
+    exit 1
+fi
+
+# Check prerequisites
+print_status "Checking prerequisites..."
+
+# Check Docker
+if ! command -v docker &> /dev/null; then
+    print_error "Docker is not installed. Please install Docker first."
+    exit 1
+fi
+
+# Check Docker Compose
+if ! command -v docker-compose &> /dev/null; then
+    print_error "Docker Compose is not installed. Please install Docker Compose first."
+    exit 1
+fi
+
+# Check .NET
+if ! command -v dotnet &> /dev/null; then
+    print_error ".NET SDK is not installed. Please install .NET 9.0 SDK first."
+    exit 1
+fi
+
+# Check .NET version
+DOTNET_VERSION=$(dotnet --version | cut -d. -f1)
+if [ "$DOTNET_VERSION" -lt "8" ]; then
+    print_warning "Detected .NET version $(dotnet --version). Recommended: .NET 8.0 or higher."
+fi
+
+print_success "All prerequisites are installed"
+
+# Setup environment file
+print_status "Setting up environment configuration..."
+
+if [ ! -f ".env" ]; then
+    if [ -f ".env.example" ]; then
+        cp .env.example .env
+        print_success "Created .env file from .env.example"
+    else
+        print_warning ".env.example not found, creating basic .env file"
+        cat > .env << EOF
+# Development Environment Configuration
+ASPNETCORE_ENVIRONMENT=Development
+DB_PASSWORD=Dev@Passw0rd123!
+JWT_SECRET_KEY=your-super-secret-jwt-key-here-minimum-32-characters
+JWT_ISSUER=HealthySystem
+JWT_AUDIENCE=HealthySystemUsers
+JWT_EXPIRY_MINUTES=60
+EOF
+        print_success "Created basic .env file"
+    fi
+else
+    print_success "Environment file already exists"
+fi
+
+# Start database container
+print_status "Starting database container..."
+docker-compose -f docker-compose.dev.yml up -d healthy-db
+
+# Wait for database to be ready
+print_status "Waiting for database to be ready..."
+sleep 10
+
+# Test database connection
+MAX_ATTEMPTS=30
+ATTEMPT=1
+while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
+    if docker-compose -f docker-compose.dev.yml exec -T healthy-db /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "Dev@Passw0rd123" -C -Q "SELECT 1" > /dev/null 2>&1; then
+        print_success "Database is ready!"
+        break
+    else
+        print_status "Waiting for database... (attempt $ATTEMPT/$MAX_ATTEMPTS)"
+        sleep 3
+        ATTEMPT=$((ATTEMPT + 1))
+    fi
+done
+
+if [ $ATTEMPT -gt $MAX_ATTEMPTS ]; then
+    print_error "Database failed to start after $MAX_ATTEMPTS attempts"
+    exit 1
+fi
+
+# Restore .NET packages
+print_status "Restoring .NET packages..."
+cd Healthy
+dotnet restore
+
+if [ $? -eq 0 ]; then
+    print_success "Packages restored successfully"
+else
+    print_error "Failed to restore packages"
+    exit 1
+fi
+
+# Build the solution
+print_status "Building the solution..."
+dotnet build
+
+if [ $? -eq 0 ]; then
+    print_success "Solution built successfully"
+else
+    print_error "Failed to build solution"
+    exit 1
+fi
+
+# Run database migrations
+print_status "Running database migrations..."
+dotnet ef database update --project Healthy.Infrastructure --startup-project Healthy.Api
+
+if [ $? -eq 0 ]; then
+    print_success "Database migrations completed"
+else
+    print_warning "Database migrations failed, but continuing..."
+fi
+
+cd ..
+
+# Setup performance testing
+print_status "Setting up performance testing..."
+if [ -d "performance-tests" ]; then
+    cd performance-tests
+    if command -v npm &> /dev/null; then
+        npm install
+        print_success "Performance testing dependencies installed"
+    else
+        print_warning "npm not found, performance testing setup skipped"
+    fi
+    cd ..
+fi
+
+# Final status
+print_success "🎉 Development environment setup completed!"
+echo
+echo "📋 Next steps:"
+echo "  1. Start the API: cd Healthy && dotnet run --project Healthy.Api"
+echo "  2. Open browser: http://localhost:5001/swagger"
+echo "  3. Check health: http://localhost:5001/health"
+echo
+echo "🐳 Container commands:"
+echo "  • Start all services: docker-compose -f docker-compose.dev.yml up -d"
+echo "  • Stop all services: docker-compose -f docker-compose.dev.yml down"
+echo "  • View logs: docker-compose -f docker-compose.dev.yml logs -f"
+echo
+echo "🧪 Testing commands:"
+echo "  • Run tests: cd Healthy && dotnet test"
+echo "  • Performance tests: cd performance-tests && npm test"
+echo
+echo "📚 Documentation:"
+echo "  • Setup guide: README.SETUP.md"
+echo "  • CI/CD guide: docs/CI-CD.md"
+echo "  • Architecture: README.Architecture.md"
+echo
+print_success "Happy coding! 🚀"
\ No newline at end of file
diff --git a/scripts/validate-cicd.sh b/scripts/validate-cicd.sh
new file mode 100755
index 0000000..799aa3a
--- /dev/null
+++ b/scripts/validate-cicd.sh
@@ -0,0 +1,285 @@
+#!/bin/bash
+
+# 🔍 Healthy System - CI/CD Validation Script
+# This script validates the CI/CD pipeline locally
+
+set -e  # Exit on any error
+
+echo "🔍 Validating Healthy System CI/CD Pipeline..."
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Function to print colored output
+print_status() {
+    echo -e "${BLUE}[INFO]${NC} $1"
+}
+
+print_success() {
+    echo -e "${GREEN}[SUCCESS]${NC} $1"
+}
+
+print_warning() {
+    echo -e "${YELLOW}[WARNING]${NC} $1"
+}
+
+print_error() {
+    echo -e "${RED}[ERROR]${NC} $1"
+}
+
+# Validation counters
+CHECKS_PASSED=0
+CHECKS_FAILED=0
+CHECKS_WARNING=0
+
+# Function to run validation check
+run_check() {
+    local check_name="$1"
+    local check_command="$2"
+    local is_critical="${3:-true}"
+    
+    print_status "Checking: $check_name"
+    
+    if eval "$check_command" > /dev/null 2>&1; then
+        print_success "✅ $check_name"
+        CHECKS_PASSED=$((CHECKS_PASSED + 1))
+        return 0
+    else
+        if [ "$is_critical" = "true" ]; then
+            print_error "❌ $check_name"
+            CHECKS_FAILED=$((CHECKS_FAILED + 1))
+        else
+            print_warning "⚠️ $check_name"
+            CHECKS_WARNING=$((CHECKS_WARNING + 1))
+        fi
+        return 1
+    fi
+}
+
+# Check if running in correct directory
+if [ ! -f "Healthy/Healthy.sln" ]; then
+    print_error "Please run this script from the project root directory"
+    exit 1
+fi
+
+echo "🧪 Running CI/CD Pipeline Validation..."
+echo
+
+# 1. Prerequisites Check
+print_status "=== Prerequisites Validation ==="
+
+run_check "Docker installed" "command -v docker"
+
+# Check Docker Compose (both legacy and new formats)
+if command -v docker-compose &> /dev/null; then
+    print_success "✅ Docker Compose installed (legacy)"
+    CHECKS_PASSED=$((CHECKS_PASSED + 1))
+elif docker compose version &> /dev/null; then
+    print_success "✅ Docker Compose installed (new)"
+    CHECKS_PASSED=$((CHECKS_PASSED + 1))
+else
+    print_error "❌ Docker Compose not available"
+    CHECKS_FAILED=$((CHECKS_FAILED + 1))
+fi
+
+run_check ".NET SDK installed" "command -v dotnet"
+run_check "Git installed" "command -v git"
+
+# Check .NET version
+DOTNET_VERSION=$(dotnet --version 2>/dev/null || echo "0.0.0")
+MAJOR_VERSION=$(echo $DOTNET_VERSION | cut -d. -f1)
+if [ "$MAJOR_VERSION" -ge "8" ]; then
+    print_success "✅ .NET version: $DOTNET_VERSION"
+    CHECKS_PASSED=$((CHECKS_PASSED + 1))
+else
+    print_warning "⚠️ .NET version: $DOTNET_VERSION (recommended: 8.0+)"
+    CHECKS_WARNING=$((CHECKS_WARNING + 1))
+fi
+
+echo
+
+# 2. Project Structure Validation
+print_status "=== Project Structure Validation ==="
+
+run_check "Solution file exists" "test -f Healthy/Healthy.sln"
+run_check "API project exists" "test -f Healthy/Healthy.Api/Healthy.Api.csproj"
+run_check "Application project exists" "test -f Healthy/Healthy.Application/Healthy.Application.csproj"
+run_check "Domain project exists" "test -f Healthy/Healthy.Domain/Healthy.Domain.csproj"
+run_check "Infrastructure project exists" "test -f Healthy/Healthy.Infrastructure/Healthy.Infrastructure.csproj"
+run_check "Test project exists" "test -f Healthy/Healthy.Tests.Unit/Healthy.Tests.Unit.csproj"
+run_check "Dockerfile exists" "test -f Healthy/Healthy.Api/Dockerfile"
+
+echo
+
+# 3. CI/CD Configuration Validation
+print_status "=== CI/CD Configuration Validation ==="
+
+run_check "Main CI/CD workflow exists" "test -f .github/workflows/ci-cd.yml"
+run_check "PR validation workflow exists" "test -f .github/workflows/pr-validation.yml"
+run_check "Security scan workflow exists" "test -f .github/workflows/security-scan.yml"
+run_check "Release workflow exists" "test -f .github/workflows/release.yml"
+run_check "Dependency update workflow exists" "test -f .github/workflows/dependency-update.yml"
+run_check "Development docker-compose exists" "test -f docker-compose.dev.yml"
+run_check "Production docker-compose exists" "test -f docker-compose.prod.yml"
+
+echo
+
+# 4. Security Files Validation
+print_status "=== Security Configuration Validation ==="
+
+run_check "Security policy exists" "test -f SECURITY.md"
+run_check "Dependabot config exists" "test -f .github/dependabot.yml"
+run_check "Gitignore exists" "test -f .gitignore"
+
+# Check for common security anti-patterns
+if grep -r "password\|secret\|key" --include="*.cs" --include="*.json" Healthy/ | grep -i "hardcoded\|admin\|123" > /dev/null 2>&1; then
+    print_warning "⚠️ Potential hardcoded secrets found"
+    CHECKS_WARNING=$((CHECKS_WARNING + 1))
+else
+    print_success "✅ No obvious hardcoded secrets found"
+    CHECKS_PASSED=$((CHECKS_PASSED + 1))
+fi
+
+echo
+
+# 5. Performance Testing Validation
+print_status "=== Performance Testing Validation ==="
+
+run_check "Performance tests directory exists" "test -d performance-tests"
+run_check "Artillery config exists" "test -f performance-tests/load-test.yml"
+run_check "Performance package.json exists" "test -f performance-tests/package.json"
+run_check "Performance README exists" "test -f performance-tests/README.md"
+
+echo
+
+# 6. Build Validation
+print_status "=== Build Validation ==="
+
+print_status "Restoring packages..."
+cd Healthy
+if dotnet restore > /dev/null 2>&1; then
+    print_success "✅ Package restore successful"
+    CHECKS_PASSED=$((CHECKS_PASSED + 1))
+else
+    print_error "❌ Package restore failed"
+    CHECKS_FAILED=$((CHECKS_FAILED + 1))
+fi
+
+print_status "Building solution..."
+if dotnet build --no-restore > /dev/null 2>&1; then
+    print_success "✅ Build successful"
+    CHECKS_PASSED=$((CHECKS_PASSED + 1))
+else
+    print_error "❌ Build failed"
+    CHECKS_FAILED=$((CHECKS_FAILED + 1))
+fi
+
+cd ..
+
+echo
+
+# 7. Docker Validation
+print_status "=== Docker Configuration Validation ==="
+
+print_status "Validating Dockerfile syntax..."
+if docker build -t healthy-api:test-validation -f Healthy/Healthy.Api/Dockerfile Healthy --dry-run > /dev/null 2>&1; then
+    print_success "✅ Dockerfile syntax valid"
+    CHECKS_PASSED=$((CHECKS_PASSED + 1))
+else
+    print_warning "⚠️ Dockerfile validation inconclusive (network issues possible)"
+    CHECKS_WARNING=$((CHECKS_WARNING + 1))
+fi
+
+# Check docker-compose syntax
+if command -v docker-compose &> /dev/null; then
+    COMPOSE_CMD="docker-compose"
+else
+    COMPOSE_CMD="docker compose"
+fi
+
+if $COMPOSE_CMD -f docker-compose.dev.yml config > /dev/null 2>&1; then
+    print_success "✅ Development docker-compose valid"
+    CHECKS_PASSED=$((CHECKS_PASSED + 1))
+else
+    print_error "❌ Development docker-compose invalid"
+    CHECKS_FAILED=$((CHECKS_FAILED + 1))
+fi
+
+if $COMPOSE_CMD -f docker-compose.prod.yml config > /dev/null 2>&1; then
+    print_success "✅ Production docker-compose valid"
+    CHECKS_PASSED=$((CHECKS_PASSED + 1))
+else
+    print_error "❌ Production docker-compose invalid"
+    CHECKS_FAILED=$((CHECKS_FAILED + 1))
+fi
+
+echo
+
+# 8. Documentation Validation
+print_status "=== Documentation Validation ==="
+
+run_check "Main README exists" "test -f README.md"
+run_check "Setup documentation exists" "test -f README.SETUP.md"
+run_check "Architecture documentation exists" "test -f README.Architecture.md"
+run_check "CI/CD documentation exists" "test -f docs/CI-CD.md" "false"
+
+echo
+
+# Final Results
+echo "🏁 Validation Results Summary:"
+echo "================================================"
+echo -e "${GREEN}✅ Passed: $CHECKS_PASSED${NC}"
+echo -e "${YELLOW}⚠️ Warnings: $CHECKS_WARNING${NC}"
+echo -e "${RED}❌ Failed: $CHECKS_FAILED${NC}"
+echo "================================================"
+
+TOTAL_CHECKS=$((CHECKS_PASSED + CHECKS_WARNING + CHECKS_FAILED))
+SUCCESS_RATE=$((CHECKS_PASSED * 100 / TOTAL_CHECKS))
+
+echo "📊 Success Rate: $SUCCESS_RATE%"
+
+if [ $CHECKS_FAILED -eq 0 ]; then
+    if [ $CHECKS_WARNING -eq 0 ]; then
+        print_success "🎉 All validations passed! CI/CD pipeline is ready."
+        echo
+        echo "🚀 Next steps:"
+        echo "  • Push your changes to trigger the CI/CD pipeline"
+        echo "  • Create a pull request to test PR validation"
+        echo "  • Check GitHub Actions for pipeline execution"
+    else
+        print_warning "✅ Core validations passed with some warnings."
+        echo
+        echo "🔧 Recommended improvements:"
+        echo "  • Address the warnings above"
+        echo "  • Consider adding missing optional components"
+    fi
+    
+    echo
+    echo "📋 CI/CD Pipeline Features:"
+    echo "  ✅ Automated building and testing"
+    echo "  ✅ Docker containerization"
+    echo "  ✅ Security scanning"
+    echo "  ✅ Performance testing"
+    echo "  ✅ Multi-environment deployment"
+    echo "  ✅ Quality gates and validation"
+    
+    exit 0
+else
+    print_error "❌ Some critical validations failed."
+    echo
+    echo "🔧 Required fixes:"
+    echo "  • Fix the failed checks above"
+    echo "  • Ensure all prerequisites are installed"
+    echo "  • Verify project structure and configuration"
+    echo
+    echo "📚 Help resources:"
+    echo "  • Setup guide: README.SETUP.md"
+    echo "  • CI/CD documentation: docs/CI-CD.md"
+    echo "  • Architecture guide: README.Architecture.md"
+    
+    exit 1
+fi
\ No newline at end of file