Security: fix scanner findings 2026-10-05

[ChiefGyk3D]

Summary

Weekly security-scan triage. One medium-severity Scorecard finding fixed; the rest are issue-only.

Alert → Issue	Tool	Severity	Change made
SecurityPolicyID → #15	Scorecard	medium	Added SECURITY.md

Fixes #15

Needs attention

Not addressed in this PR (issue-only, no viable code fix this run — see each issue for reasoning):

• [Security] high Scorecard: BranchProtectionID — branch protection not maximal on master #13, [Security] high Scorecard: CodeReviewID — 0/20 changesets approved #14 — BranchProtectionID / CodeReviewID: repository Settings change, not code
• [Security] medium Scorecard: SecurityPolicyID — no SECURITY.md #16 — SASTID: rolling historical metric, rises automatically as commits land through CI's existing scanning
• [Security] medium Scorecard: SASTID — SAST tool not run on all commits (1/13) #17 — FuzzingID: no fuzzable surface in this Compose-orchestration codebase
• [Security] medium Scorecard: FuzzingID — project is not fuzzed #18 — PinnedDependenciesID (downloadThenRun): false positive — flagged lines are curl to this stack's own local Grafana API piped into a literal python3 parser, never remote code execution. Could not be dismissed programmatically (GitHub API proxy blocks code-scanning-alert writes from this sandbox).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GS1ZwURfozKePu3FS9qamF

---

Generated by Claude Code