Follow-up from act CI quality review. security.yml covers integrity (go mod verify, uv pip check) but no CVE database is consulted anywhere. Add govulncheck for apps/api and pip-audit/osv-scanner for Python, or document why not. Tracked for ci-hardening.
Follow-up from act CI quality review. security.yml covers integrity (go mod verify, uv pip check) but no CVE database is consulted anywhere. Add govulncheck for apps/api and pip-audit/osv-scanner for Python, or document why not. Tracked for ci-hardening.