Author	SHA1	Message	Date
Fimeg	c3037655cd	docs: bind the supply-chain claims to the helper	2026-08-25 08:26:05 -04:00
Fimeg	7427174d99	deps: lift patched public floors ... CI found nine reachable Go issues and a high Axios advisory. Move to the published fixed floors and retire three stale Docker exceptions.	2026-08-20 13:14:28 -04:00
Fimeg	b3d946b84f	fix: add Docker daemon-side vulns to allowlist ... Add GO-2026-5617, GO-2026-5668, and GO-2026-5746 to .govulncheck-allow. These are all daemon-side Docker/Moby vulnerabilities that don't affect RedFlag because it uses the Docker client only for Ping, SecretList, and container scanning — never for docker cp, archive operations, or AuthZ paths. Also update SECURITY.md to document all accepted exceptions in a table.	2026-06-29 16:35:04 -04:00
Fimeg	e2dab2845a	supply-chain: gate our own deps, ship the verdict signed ... dep-scan.sh gates go/npm/cargo on push and bakes an attested posture into the release — embedded in the server, signed into the manifest. Reasoning and the two Moby exceptions are in SECURITY.md. (posture-builder runs rustup; bookworm's cargo is too old for cargo-audit.)	2026-06-14 11:43:23 -04:00
Fimeg	565baa0819	AUTHOR.md + SECURITY.md split out; README restructured for public eyes	2026-06-11 11:32:19 -04:00