Security Scan: 0 critical, 1 high findings - 2026-05-10

[github-actions]

Weekly Security Scan Report

Scan Date: 2026-05-10T02:35:15Z
Workflow Run: #22

Summary

Metric	Value
Total Skills Scanned	676
Passed (Safe)	675
Quarantined	1

Findings by Severity

Severity	Count
CRITICAL	0
HIGH	1
MEDIUM	2
LOW	673

Risk Scores

• Average Risk Score: 0
• Maximum Risk Score: 1

Action Required

1. Download the quarantine-skills artifact from the workflow run
2. Review each quarantined skill for legitimate security concerns
3. Either fix the issues or add to the allowlist with justification

Artifacts

• security-report.json - Full scan results
• quarantine-skills.json - Skills requiring review
• safe-skills.json - Approved skills

---

Auto-generated by weekly-security-scan workflow

[github-actions]

Weekly Security Scan Report

Scan Date: 2026-05-17T02:42:48Z
Workflow Run: #23

Summary

Metric	Value
Total Skills Scanned	984
Passed (Safe)	983
Quarantined	1

Findings by Severity

Severity	Count
CRITICAL	1
HIGH	1
MEDIUM	4
LOW	978

Risk Scores

• Average Risk Score: 0.02
• Maximum Risk Score: 20

Action Required

1. Download the quarantine-skills artifact from the workflow run
2. Review each quarantined skill for legitimate security concerns
3. Either fix the issues or add to the allowlist with justification

Artifacts

• security-report.json - Full scan results
• quarantine-skills.json - Skills requiring review
• safe-skills.json - Approved skills

---

Auto-generated by weekly-security-scan workflow

[github-actions]

Weekly Security Scan Report

Scan Date: 2026-05-24T02:50:49Z
Workflow Run: #25

Summary

Metric	Value
Total Skills Scanned	1187
Passed (Safe)	1186
Quarantined	1

Findings by Severity

Severity	Count
CRITICAL	0
HIGH	2
MEDIUM	5
LOW	1180

Risk Scores

• Average Risk Score: 0
• Maximum Risk Score: 1

Action Required

1. Download the quarantine-skills artifact from the workflow run
2. Review each quarantined skill for legitimate security concerns
3. Either fix the issues or add to the allowlist with justification

Artifacts

• security-report.json - Full scan results
• quarantine-skills.json - Skills requiring review
• safe-skills.json - Approved skills

---

Auto-generated by weekly-security-scan workflow

[github-actions]

Weekly Security Scan Report

Scan Date: 2026-05-31T02:59:50Z
Workflow Run: #26

Summary

Metric	Value
Total Skills Scanned	1188
Passed (Safe)	1187
Quarantined	1

Findings by Severity

Severity	Count
CRITICAL	0
HIGH	1
MEDIUM	5
LOW	1182

Risk Scores

• Average Risk Score: 0
• Maximum Risk Score: 1

Action Required

1. Download the quarantine-skills artifact from the workflow run
2. Review each quarantined skill for legitimate security concerns
3. Either fix the issues or add to the allowlist with justification

Artifacts

• security-report.json - Full scan results
• quarantine-skills.json - Skills requiring review
• safe-skills.json - Approved skills

---

Auto-generated by weekly-security-scan workflow

[wrsmith108]

Resolved. The full security surface is now clean as of 2026-06-12:

• Dependabot alerts: 0 open (was 10). Cleared via fix(deps): override axios@^1.17.0 + bump turbo@2.9.14 — clear 8 Dependabot alerts (SMI-5266) #1421 (SMI-5266 — esbuild override → ^0.28.1 + dropped unused esbuild prod deps; axios override; turbo 2.9.14) and fix(deps): clear remaining dev-scope Dependabot alerts — tmp + nested esbuild (SMI-5268) #1423 (SMI-5268 — tmp → 0.2.7; nested phase4-orchestrator esbuild → 0.28.1). Fixed: esbuild feat: refactor indexer into modules, expand discovery, add observability (SMI-2563) #150/fix: wave 3 code quality improvements for indexer (SMI-2573-2578) #151, tmp feat(standards): add a11y patterns to standards-astro.md and audit check (SMI-2543) #133, axios fix(a11y): add link underlines and fix pricing gradient contrast #136/fix(a11y): resolve remaining 7 Lighthouse failures #137/fix(a11y): add missing underline to license contact links #138/fix(a11y): dark-theme button utilities and semantic ToC heading #139/fix: retro action items - shared quarantine, ops-report split, email audit (SMI-2560, SMI-2561, SMI-2562) #145/docs: update retro and deployment guide for PR #145 #146, turbo fix(lint): add *.cjs to ESLint global ignores #130/fix(a11y): callout heading order and copy button aria-label (SMI-2539) #131.
• Code-scanning: 0 open — alert fix(indexer): Wave 6 — scanner performance and indexer robustness #97 (js/request-forgery, apps/api-proxy/api/proxy.ts) dismissed as a false positive (hardened under SMI-4862: origin-equality + path allow-list + pre-parse rejection; CodeQL can't see the guards).
• Secret-scanning: 0 open.

The "1 high" this issue tracked was the dependency situation, now fully remediated. Closing.