Problem
.github/workflows/ contains only backend-tests.yml and sdk-tests.yml. There is no Dependabot configuration, no CodeQL workflow, and no scheduled or PR-triggered vulnerability scan of either the Python (requirements.txt) or JavaScript (package-lock.json) dependency trees.
Why this matters
The project pulls in torch, transformers, peft, and several other packages with active CVE histories, plus a full Next.js/React frontend dependency tree. Without automated scanning, a known vulnerability in a direct or transitive dependency would only be discovered manually — which, in practice, means it wouldn't be discovered at all until something goes wrong.
Acceptance Criteria
Files likely to modify
.github/dependabot.yml
.github/workflows/codeql.yml
SECURITY.md
Skills required
GitHub Actions, basic security tooling familiarity
Estimated difficulty
2/5
Estimated effort
2–4 hours
Problem
.github/workflows/ contains only backend-tests.yml and sdk-tests.yml. There is no Dependabot configuration, no CodeQL workflow, and no scheduled or PR-triggered vulnerability scan of either the Python (requirements.txt) or JavaScript (package-lock.json) dependency trees.
Why this matters
The project pulls in torch, transformers, peft, and several other packages with active CVE histories, plus a full Next.js/React frontend dependency tree. Without automated scanning, a known vulnerability in a direct or transitive dependency would only be discovered manually — which, in practice, means it wouldn't be discovered at all until something goes wrong.
Acceptance Criteria
A .github/dependabot.yml is added covering both the Python (pip) and npm ecosystems, with a reasonable update schedule (e.g., weekly)
A CodeQL analysis workflow is added for both Python and JavaScript/TypeScript
Both are confirmed to run successfully on a test PR
SECURITY.md is updated to mention automated scanning is in place
Documentation updated if necessary
Files likely to modify
.github/dependabot.yml
.github/workflows/codeql.yml
SECURITY.md
Skills required
GitHub Actions, basic security tooling familiarity
Estimated difficulty
2/5
Estimated effort
2–4 hours