Security scan results

Generated from the latest security run on main. Every scanner is listed with what it did; a scanner that did not run says so and is never counted as zero findings. results.json has everything, the security model explains the design, and SECURITY.md says how to report a vulnerability.

Loading the latest results…

How findings are handled

• A fixable critical blocks a release and a pull request.
• A finding is accepted only when it is shown to be unreachable or not a vulnerability where it stands, and the acceptance records how.
• “No fix available” is never a reason to dismiss: such findings stay in the table above.

The full policy is in SECURITY.md.