security-checkup

Deterministic, no-AI security scan of the current repo: dependency advisories (osv-scanner), committed secrets (gitleaks), unsafe-pattern taint rules (semgrep), and the project verify gate. Normalizes every result into one Finding schema, writes .security/report.json + report.md, and exits with a CI-gateable contract. Makes no model calls and needs no API key.