Drive Dependabot and secret-scanning SLO backlog to zero critical/high

[haasonsaas]

Summary

The engineering-practices audit reports 216 open Dependabot alerts and 36 open secret-scanning alerts across the org. CodeQL and GitHub default code scanning are explicitly excluded from this practice; this issue is only for the bounded dependency and secret-alert backlog.

Why it matters

The new audit gives us a single live signal, but the backlog still needs ownership and burn-down. Critical/high dependency issues and open secret alerts are operational risk even when repo rails are now present.

What to do

• Export the current Dependabot critical/high alert list and secret-scanning alert list from the audit source.
• Group by owning repo and by fix type: version bump, replacement, accepted risk, revoked/rotated secret, or false positive.
• File or link repo-scoped PRs/issues for the real fixes.
• Keep this bounded to Dependabot and secret scanning; do not enable CodeQL or default code scanning.

Acceptance criteria

• Every critical/high Dependabot alert has a linked fix, suppression rationale, or owner.
• Every open secret-scanning alert has a linked rotation/revocation/false-positive disposition.
• The engineering-practices audit can report zero critical/high dependency alerts and zero untriaged secret alerts, or explain explicit accepted-risk exceptions.

[haasonsaas]

Live triage update from the engineering-practices audit:\n\n## Repo-scoped remediation issues created\n\n- evalops/cerebro#1238\n- evalops/chat#972\n- evalops/conductor#403\n- evalops/daybook#7\n- evalops/deep-code-reasoning-mcp#42\n- evalops/ensemble#1226\n- evalops/eval2otel#51\n- evalops/experiments#18\n- evalops/fabric#33\n- evalops/gam-workspace-config#8\n- evalops/lark#8\n- evalops/maestro#464\n- evalops/maestro-internal#2044\n- evalops/nimbus#47\n- evalops/proto-docs#7\n- evalops/relay#6\n\n## Archived repo exception\n\n- evalops/fermata is archived and has open secret-scanning alerts. This needs an org-level disposition: temporarily unarchive for rotation/false-positive closure, or document accepted risk with expiry. Secret values and locations are intentionally omitted from issues/comments.\n\nNo CodeQL or GitHub default code scanning was enabled or requested.

[haasonsaas]

Checkpoint: scoped high/critical backlog is at zero as of 2026-05-20T06:58Z.

Live verification across the scoped repos (cerebro, chat, conductor, daybook, deep-code-reasoning-mcp, ensemble, eval2otel, experiments, fabric, gam-workspace-config, lark, maestro, maestro-internal, nimbus, proto-docs, relay):

• Open high/critical Dependabot alerts: 0
• Open secret-scanning alerts: 0

Merged remediation PRs in this tranche:

• evalops/relay#7 -> b1dd939b1838be45558139c82b31926df196221d
• evalops/proto-docs#8 -> 75d0062ba5cf8f88989aba39030cf9df57de69a5
• evalops/conductor#404 -> 5e4e7d3aee48c8a2a2eb083dafdf6bec510f7d78
• evalops/fabric#34 -> dd42c494823d09625e510abe4e0a0934e68e191d
• [codex] fix minimatch security alerts deep-code-reasoning-mcp#43 -> 8a9a7e4b515fbd30673bce94a6996c880e367395
• [codex] fix dependency security alerts eval2otel#52 -> 90ecc997cbe7f209e0227bf71313da98c65ff2e7
• evalops/daybook#8 -> fcdd169a659d9c867b1b63389011a3f93ff7e34a
• evalops/experiments#19 -> dfe39955e6679b5e5f55bf5afd0e4e3a7723ad56
• [codex] upgrade desktop packaging security baseline lark#9 -> 06e094811b0dd88537edf0f8c49f9fe83cd44961
• evalops/chat#973 -> d8c8a146589e99ccba471f2dc473af03651abae6
• evalops/maestro-internal#2052 -> b0cad5032cf2e765d0966aafaf7d1ea897496161
• [codex] fix security dependency alerts maestro#465 -> bffdba92f41722073a36781c5016ff896443c2de
• evalops/gam-workspace-config#9 -> cfce091791adde56731e27cd3b15a1ede5bedf56

Secret-scanning dispositions:

• Historical scanner/redaction fixtures: resolved as used_in_tests.
• Provider catalog examples and non-secret OAuth client IDs: resolved as false_positive.
• GAM current-source OAuth fallback metadata: removed in evalops/gam-workspace-config#9, then historical alerts resolved.
• Public installed-app Google OAuth client secrets in Maestro/Maestro-internal: resolved as explicit wont_fix exceptions because they support local Google OAuth compatibility and are not EvalOps service credentials. Follow-ups were opened to remove that exception: [security-slo] Remove Google installed-app OAuth client-secret exception maestro#466 and evalops/maestro-internal#2053.

Archived fermata remains the only repo-level disposition gap from the original inventory: it still needs unarchive/remediate or accepted-risk-with-expiry.

Important guardrail: no CodeQL/default code scanning was enabled. This sweep used Dependabot, existing repo checks, Socket where already configured, and GitHub secret-scanning triage only.