diff --git a/FEATURE_REQUESTS.md b/FEATURE_REQUESTS.md
new file mode 100644
index 0000000..45afd5a
--- /dev/null
+++ b/FEATURE_REQUESTS.md
@@ -0,0 +1,59 @@
+# Feature Requests
+
+> Backlog of feature ideas to triage into future sprints (e.g., Sprint 6/7).
+
+## Security Vulnerability Awareness (Dependencies)
+
+**Goal:** Warn when a dependency has known vulnerabilities and surface safer alternatives.
+
+**Concept:**
+- Maintain a vulnerability knowledge base (local cache + optional remote sources).
+- When a dependency is added/updated, show immediate warnings.
+- Surface findings in the Dependencies panel and Problems list.
+- Optionally block auto-upgrade to vulnerable versions.
+
+**Potential Data Sources:**
+- OSV (Open Source Vulnerabilities) API / datasets
+- NVD (CVE/NVD feeds)
+- GitHub Security Advisories (GHSA)
+- OWASP references (for categorization)
+
+**Candidate Data Model:**
+- `VulnerabilityRecord`
+  - `ecosystem` (pypi/npm/crates/maven/go/vcpkg/etc)
+  - `package`
+  - `affected_versions`
+  - `severity`
+  - `summary`
+  - `references`
+
+**UI/UX:**
+- Dependencies panel: inline warning badges and “View Advisory”.
+- Problems panel: security diagnostics with severity.
+- Agent hints: prefer safe alternatives when available.
+
+---
+
+## Semantic Annotations for Library APIs
+
+**Goal:** Tag library functions/types with semantic annotations (e.g., `@serialize`, `@crypto`, `@io`) so humans/agents can discover intent-driven APIs quickly.
+
+**Concept:**
+- Add annotation metadata for library symbols (by library + symbol).
+- Attach annotations to `ExternalModule` / `TypeSignature` nodes.
+- Use annotations to filter in Library Browser and guide agent completion.
+
+**Candidate Storage:**
+- `annotations/library_semanno.json` (or similar)
+- Format: `{ library: { symbol: [annotations...] } }`
+
+**UI/UX:**
+- Library Browser: filter by annotation tag.
+- Completion ranking: prioritize annotated matches for task keywords.
+- Agent prompts: “Use @serialize APIs” guidance.
+
+---
+
+## Notes
+- Treat these as separate features to schedule independently.
+- Likely Sprint 6/7, after core library-aware flow is stable.
diff --git a/PROGRESS.md b/PROGRESS.md
index 49ecf87..e993529 100644
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -481,3 +481,4 @@ Sprint 5 in progress. Step 135 (library-aware completion) done. Next: Step 136 (
 | 2026-02-09 | Codex | Step 133: Import statement generation + unused import warnings across Python/JS/Rust/Go/Elisp with auto-insert on library symbol use. 7/7 tests pass. |
 | 2026-02-09 | Codex | Step 134: PrimitivesRegistry aggregating builtins, imports, and in-scope symbols. 6/6 tests pass. |
 | 2026-02-09 | Codex | Step 135: Library-aware completion ordering with auto-import hints for non-primitive symbols. 5/5 tests pass. |
+| 2026-02-09 | Codex | Added FEATURE_REQUESTS.md to track security vulnerability awareness and semantic library annotations for future sprints. |