diff --git a/.github/ISSUE_TEMPLATE/bug-report.md b/.github/ISSUE_TEMPLATE/bug-report.md
new file mode 100644
index 0000000..a2eb9bb
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug-report.md
@@ -0,0 +1,22 @@
+---
+name: Bug report or improvement
+about: A defect or improvement in the framework itself — not your personal job search
+---
+
+<!-- Heads-up before you file: if you are working in a personalized fork,
+     note that the gh CLI points issue creation at this UPSTREAM repo by
+     default (`gh repo fork --clone` sets it as the default repository).
+     Personal application tracking, job evaluations, and incident logs
+     belong in YOUR fork or private repo - this tracker is public. Run
+     `gh repo set-default <your-username>/ai-job-search` in your clone to
+     keep your own automation pointed home (SETUP.md, section 2). -->
+
+## Description
+
+## Steps to Reproduce
+
+## Expected Behavior
+
+## Actual Behavior
+
+## Impact
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..3d12f04
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,9 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Filing from a personalized fork? Read this first
+    url: https://github.com/MadsLorentzen/ai-job-search/blob/master/SETUP.md#2-fork-and-clone
+    about: >-
+      The gh CLI in a fork clone targets THIS public repo by default. Personal
+      application tracking, evaluations, and incident logs belong in your own
+      fork or private repo — run `gh repo set-default <you>/ai-job-search`
+      there to keep your automation pointed home.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ad42af3..4ff9e03 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,17 @@ per-file diff commands.
 
 ### Fixed
 
+- **Fork clones no longer point `gh issue create` at the upstream public tracker
+  undetected** (#389) - `gh repo fork --clone`, the exact command SETUP.md's fork step
+  recommends, sets the *upstream* repo as gh's default repository, and gh uses the
+  default for creating issues and PRs - so a user's own automation ("file a tracking
+  issue per application") silently published personal job-search data on the upstream
+  repo, under the user's identity, where they cannot delete it (four live instances from
+  two users in one week). SETUP.md section 2 now adds `gh repo set-default
+  <your-username>/ai-job-search` directly to the fork commands with a warning at the
+  point of decision (the #348 pattern), and a new `.github/ISSUE_TEMPLATE/` carries the
+  same heads-up the PR template already had, for the web-UI path. Blank issues stay
+  enabled - the template warns, it does not gatekeep.
 - **`freehire-search` fractional numeric flags no longer silently change the query** (#373) -
   `parseIntFlag` used bare `parseInt`, so a fractional value was truncated instead of
   rejected: `--jobage 0.5` became `0`, failed the `jobage > 0` guard, and the
diff --git a/SETUP.md b/SETUP.md
index 754f090..1443a93 100644
--- a/SETUP.md
+++ b/SETUP.md
@@ -158,10 +158,19 @@ If a command still uses `pdftotext -layout`, it must pass `-enc UTF-8` as well.
 ```bash
 gh repo fork MadsLorentzen/ai-job-search --clone
 cd ai-job-search
+gh repo set-default <your-github-username>/ai-job-search
 ```
 
 Or manually: fork on GitHub, then clone your fork.
 
+> **The `set-default` line is not optional.** `gh repo fork --clone` sets the
+> **upstream** repo as gh's default repository ("The `upstream` remote will be set as
+> the default remote repository" — `gh repo fork --help`), and gh uses the default for
+> **creating issues and PRs**. Without it, any later `gh issue create` run from this
+> clone — by you or by an agent you have asked to track your applications — silently
+> files on the upstream **public** tracker, publishing whatever the issue contains
+> under your GitHub identity, on a repo where you cannot delete it (#389).
+
 > **Before you go further: forks are public.** GitHub cannot make a fork of a public
 > repository private, and `/setup` (section 6) writes your personal data into **tracked**
 > files — pushing those commits to a fork publishes them. If this copy is for your own