📦 deps(thirdparty): update snapshots
This commit is contained in:
@@ -0,0 +1,35 @@
|
||||
# Local Security Scan Goal
|
||||
|
||||
## Outcome
|
||||
|
||||
Eliminate the current repo-wide local security scanner error backlog so `npm run security:scan` exits successfully.
|
||||
|
||||
## Baseline
|
||||
|
||||
As of 2026-07-05, the broad local scanner reports 38 error findings after the CSV-backed Codex security remediation was completed. The failures are mostly `SEC009` hardcoded credential examples, plus `SEC002`, `SEC004`, and `SEC011` documentation patterns.
|
||||
|
||||
## Scope
|
||||
|
||||
- Fix canonical skill sources under `skills/`.
|
||||
- Regenerate mirrored plugin distributions after canonical edits.
|
||||
- Keep existing warning findings out of scope unless they are cheap collateral cleanup.
|
||||
- Do not weaken scanner patterns, suppress findings with broad allowlists, or narrow the scanner target to make the check pass.
|
||||
- Do not commit, push, publish, or release without a separate user request.
|
||||
|
||||
## Verification
|
||||
|
||||
Primary verifier:
|
||||
|
||||
```bash
|
||||
npm run security:scan
|
||||
```
|
||||
|
||||
Supporting checks:
|
||||
|
||||
```bash
|
||||
npm run validate
|
||||
npm run security:docs
|
||||
npm run bundles:check
|
||||
```
|
||||
|
||||
Completion proof requires the primary verifier to report zero errors and exit successfully.
|
||||
Reference in New Issue
Block a user