Harden auth, sync, and Supabase security #120

	name: 🔐 CodeQL Security Scan

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	# Runs every Monday at 09:00 UTC
	- cron: '0 9 * * 1'

	permissions:
	actions: read
	contents: read
	security-events: write

	jobs:
	analyze:
	name: Analyze JavaScript/TypeScript
	runs-on: ubuntu-latest

	steps:
	- name: ⬇️ Checkout
	uses: actions/checkout@v7

	- name: 🔍 Initialize CodeQL
	uses: github/codeql-action/init@v4
	with:
	languages: javascript-typescript
	# Config excludes public/ (154 minified React bundle files) and docs/
	# which would otherwise generate hundreds of false-positive warnings.
	# Uses security-extended only — security-and-quality adds stylistic
	# rules that are not actionable for a single-file server app.
	config-file: ./.github/codeql/codeql-config.yml

	- name: 🏗️ Autobuild
	uses: github/codeql-action/autobuild@v4

	- name: 📊 Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v4
	with:
	category: /language:javascript-typescript

Provide feedback