Problem. CI's only security step is bandit (Python SAST). There's no dependency scanning (pip-audit for backend/requirements.txt, npm audit/osv-scanner for the frontend), no image scan (Trivy/Grype) on the images built in publish-image.yml, and no CodeQL.
Why it matters. Concretely relevant — requirements.txt already carries a manual note pinning litellm to dodge a CVE, which a scanner would enforce automatically.
Suggested fix. Add pip-audit + npm audit jobs and a Trivy scan of the built images.
Problem. CI's only security step is
bandit(Python SAST). There's no dependency scanning (pip-auditforbackend/requirements.txt,npm audit/osv-scannerfor the frontend), no image scan (Trivy/Grype) on the images built inpublish-image.yml, and no CodeQL.Why it matters. Concretely relevant —
requirements.txtalready carries a manual note pinning litellm to dodge a CVE, which a scanner would enforce automatically.Suggested fix. Add
pip-audit+npm auditjobs and a Trivy scan of the built images.