DevRunbook-Public/evidence/security-scan-report.md

Release security scan report

Release candidate scans were executed on the Unraid validation host on 2026-07-27.

Check	Result	Evidence
Production dependency audit	Pass	pnpm audit --prod reported no high or critical findings. One moderate esbuild development-server advisory remains through better-auth > drizzle-kit; the affected development server is not present or exposed in the production web/worker runtime.
Runtime web image	Pass	Trivy 0.69.3 with --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 reported zero findings for the Debian and Node package inventories.
Runtime worker image	Pass	The same Trivy policy reported zero findings.
Repository secret history	Pass	Gitleaks 8.28.0 scanned 153 commits and approximately 4.99 MB with no leaks. Two exact local-development/CI encryption fixtures are narrowly classified in .gitleaks.toml; no file-wide exclusion is used.
Production license inventory	Pass	pnpm licenses list --prod --json inventoried 161 package records under 0BSD, Apache-2.0, BSD-2-Clause, BSD-3-Clause, CC-BY-4.0, ISC, LGPL-3.0-or-later, MIT, MPL-2.0 and Unlicense. No prohibited or unclassified license was found.
Application security tests	Pass	The configured suite passed 2 files and 11 tests, including dependency and production-boundary checks.

The Node base image originally included unused npm, Corepack and Yarn files with high/critical findings in their bundled tooling. Commit 601e59e removes those package managers from long-running runtime images; they remain available only in build/migration tooling where required.