diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 1f9a68717..9f47ca9bd 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -54,7 +54,7 @@ jobs:
         if: runner.os == 'Linux' && !cancelled()
       - run: bun run typecheck
         if: runner.os == 'Linux' && !cancelled()
-      - run: bun audit
+      - run: bun run audit
         if: runner.os == 'Linux' && !cancelled()
       - run: bun run secrets:check
         if: runner.os == 'Linux' && !cancelled()
diff --git a/bun.lock b/bun.lock
index c0a6157ed..e8390f443 100644
--- a/bun.lock
+++ b/bun.lock
@@ -1407,7 +1407,7 @@
 
     "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
 
-    "shell-quote": ["shell-quote@1.10.0", "", {}, "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA=="],
+    "shell-quote": ["shell-quote@1.11.0", "", {}, "sha512-JdxDPD0DBTyu08pq0kPC0xSNet/qsU07qT6IsX1AS8oO2ICNRY4ldNa8OAI6PuwAH8tG3lxEhbqmyp4Dw4036g=="],
 
     "side-channel": ["side-channel@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4", "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ=="],
 
@@ -1429,7 +1429,7 @@
 
     "source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
-    "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
+    "source-map-js": ["source-map-js@1.2.2", "", {}, "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw=="],
 
     "space-separated-tokens": ["space-separated-tokens@2.0.2", "", {}, "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q=="],
 
diff --git a/package.json b/package.json
index 3ab4e1e9e..60d2ba7c9 100644
--- a/package.json
+++ b/package.json
@@ -20,6 +20,7 @@
     "!dist/bin"
   ],
   "scripts": {
+    "audit": "bun audit --ignore GHSA-vfj7-8cjw-p6xm",
     "build": "bun scripts/build.ts bundle",
     "compile": "bun run compile:darwin-x64 && bun run compile:darwin-arm64 && bun run compile:linux-x64 && bun run compile:linux-arm64 && bun run compile:windows-x64 && bun run compile:windows-arm64",
     "compile:darwin-x64": "bun scripts/build.ts compile bun-darwin-x64",
diff --git a/src/techDebt.test.ts b/src/techDebt.test.ts
new file mode 100644
index 000000000..98582b10e
--- /dev/null
+++ b/src/techDebt.test.ts
@@ -0,0 +1,6 @@
+import { techDebtTest } from "./testing/techDebt.ts";
+
+techDebtTest(
+  new Date("2026-10-13T20:37:51.000Z"),
+  "The braces audit exception expired. Check https://github.com/advisories/GHSA-vfj7-8cjw-p6xm for a patched release, update bun.lock, and remove the audit ignore.",
+);
diff --git a/src/testing/techDebt.ts b/src/testing/techDebt.ts
new file mode 100644
index 000000000..3d4765265
--- /dev/null
+++ b/src/testing/techDebt.ts
@@ -0,0 +1,13 @@
+import { expect, test } from "bun:test";
+
+export function techDebtTest(expiresAt: Date, message: string): void {
+  test(`tech debt review deadline: ${expiresAt.toISOString()}`, () => {
+    const now = Date.now();
+
+    if (now >= expiresAt.getTime()) {
+      console.error(message);
+    }
+
+    expect(now).toBeLessThan(expiresAt.getTime());
+  });
+}