diff --git a/.clang-format b/.clang-format
new file mode 100644
index 0000000..099191d
--- /dev/null
+++ b/.clang-format
@@ -0,0 +1,10 @@
+BasedOnStyle: LLVM
+IndentWidth: 2
+ColumnLimit: 100
+PointerAlignment: Left
+AllowShortFunctionsOnASingleLine: None
+SortIncludes: false
+AllowShortIfStatementsOnASingleLine: false
+AllowShortLoopsOnASingleLine: false
+BinPackArguments: true
+BinPackParameters: true
diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 937c6dd..19713ad 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -3,15 +3,32 @@ name: CI
 on: [push, pull_request]
 
 jobs:
-  build-and-test:
+  lint:
     runs-on: ubuntu-latest
     container: gitea.tap-tap.win/taptap/fastsync-ci:v6
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install lint tools
+        run: apt-get update && apt-get install -y cppcheck clang-format
+
+      - name: clang-format check
+        run: clang-format --dry-run --Werror src/ tests/
+
+      - name: cppcheck
+        run: cppcheck --enable=warning,style,performance,portability --suppress=missingIncludeSystem --error-exitcode=1 --inline-suppr src/ tests/
+
+  build-and-test:
+    runs-on: ubuntu-latest
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v6
+    needs: lint
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Configure
-        run: cmake -B build -S .
+        run: cmake -B build -S . -DSTRICT_WARNINGS=ON
 
       - name: Build
         run: cmake --build build -j$(nproc)
@@ -21,3 +38,23 @@ jobs:
 
       - name: Integration Tests
         run: python3 -m pytest tests/ -v --tb=short
+
+  sanitizers:
+    runs-on: ubuntu-latest
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v6
+    needs: lint
+    strategy:
+      matrix:
+        sanitizer: [address, thread]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure
+        run: cmake -B build-${{ matrix.sanitizer }} -S . -DSANITIZER=${{ matrix.sanitizer }}
+
+      - name: Build
+        run: cmake --build build-${{ matrix.sanitizer }} -j$(nproc)
+
+      - name: Unit Tests
+        run: ./build-${{ matrix.sanitizer }}/tests
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 7a3fda2..2d1cf9b 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -7,9 +7,26 @@ set(CMAKE_C_STANDARD 11)
 set(CMAKE_C_STANDARD_REQUIRED ON)
 
 add_compile_options(-Wall -g -O3)
-# add_compile_options(-Wall -g -O1 -fsanitize=address)
 
-# add_link_options(-fsanitize=address)
+# --- Sanitizer option ---
+set(SANITIZER "none" CACHE STRING "Sanitizer to enable (address, thread, none)")
+set_property(CACHE SANITIZER PROPERTY STRINGS address thread none)
+
+if(SANITIZER STREQUAL "address")
+	add_compile_options(-fsanitize=address -fno-omit-frame-pointer -g)
+	add_link_options(-fsanitize=address)
+elseif(SANITIZER STREQUAL "thread")
+	add_compile_options(-fsanitize=thread -fno-omit-frame-pointer -g)
+	add_link_options(-fsanitize=thread)
+elseif(NOT SANITIZER STREQUAL "none")
+	message(FATAL_ERROR "Unknown sanitizer: ${SANITIZER}. Supported values: address, thread, none")
+endif()
+
+# --- Strict warnings option ---
+option(STRICT_WARNINGS "Enable strict warnings (Wextra, Wpedantic, Werror)" OFF)
+if(STRICT_WARNINGS)
+	add_compile_options(-Wextra -Wpedantic -Werror)
+endif()
 
 set(THREADS_PREFER_PTHREAD_FLAG ON)
 find_package(Threads REQUIRED)
diff --git a/Dockerfile b/Dockerfile
index 40deaf2..4d378a8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 FROM ubuntu:24.04
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    gcc g++ make libc6-dev cmake libzstd-dev libssl-dev git ca-certificates curl \
+    gcc g++ make libc6-dev cmake libzstd-dev libssl-dev git ca-certificates curl cppcheck clang-format \
     python3 python3-pip python3-venv openssl openssh-client && \
     pip3 install --break-system-packages pytest && \
     curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
diff --git a/src/shared/compression.c b/src/shared/compression.c
index 950f98a..76a2c1b 100644
--- a/src/shared/compression.c
+++ b/src/shared/compression.c
@@ -7,6 +7,7 @@
 #define INITIAL_DECOMPRESS_BUF_SIZE (1024 * 1024)
 
 Data *data_compress(Data *data_to_compress, int compression_level) {
+  (void)compression_level;
   log_message(LOG_LEVEL_DEBUG, "Starting to compress data");
   size_t dst_size = ZSTD_compressBound(data_to_compress->size);
   Data *compressed_data = data_create_empty(dst_size);
diff --git a/src/shared/file.c b/src/shared/file.c
index f4ca381..20337aa 100644
--- a/src/shared/file.c
+++ b/src/shared/file.c
@@ -235,7 +235,7 @@ bool file_send_sendfile(File *file, int file_descriptor, bool use_metadata, bool
   }
 
   off_t offset = 0;
-  while (offset < file_size) {
+  while ((unsigned long long)offset < file_size) {
     ssize_t sent = sendfile(file_descriptor, fd, &offset, file_size - offset);
     if (sent == -1) {
       perror("sendfile failed");
diff --git a/src/shared/protocol.c b/src/shared/protocol.c
index 73edfc2..1e121a7 100644
--- a/src/shared/protocol.c
+++ b/src/shared/protocol.c
@@ -68,7 +68,7 @@ bool send_n_data(int file_descriptor, void *data, size_t data_size) {
   log_message(LOG_LEVEL_DEBUG, "    Sending n Data: %zu", data_size);
   int fd = io_fd(io_write_fd, file_descriptor);
   ssize_t total_bytes_send = 0;
-  while (total_bytes_send < data_size) {
+  while ((size_t)total_bytes_send < data_size) {
     size_t chunk = data_size - total_bytes_send;
     if (io_bwlimit > 0 && chunk > 65536)
       chunk = 65536;