backlog(#340): the merge-queue cost, re-derived — and two false statements in the item itself #549

Job	Run time
bandit (Python SAST)	26s
crypto-inventory (ASVS 11.1.3 discovery gate)	9s
npm-audit (ide dependency vulnerabilities)	11s
gitleaks (secret scan)	12s
pip-audit (dependency vulnerabilities)	2m 9s
forbidden-content (customer/PHI leak guard)	32s
semgrep (project SAST rules)	35s
trivy (container image vulnerabilities)	-1s
SBOMs (CycloneDX, multi-ecosystem)	-8s
	4m 5s

Navigation Menu