# Changelog

## Score

- CAI 48 → 48 (+0.6)

## Lenses

- Code Health 55 → 56 (+1.2)
- Architecture 89 → 88 (-1.5)
- Maturity 53 → 58 (+4.9)
- Readiness 52 → 52 (+0.0)
- Security 68 → 66 (-2.1)
- Accessibility 39 → 39 (+0.0)
- Performance 60 → 60 (+0.0)

## Resolved (8)

- Base-context workflow trigger runs with an unscoped token
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block

## New (11)

- Base-context workflow trigger runs with an unscoped token (.github/workflows/size_report_comment.yml)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High secret: WD-SECRET-0005 (package-lock.json)
- Low CVE: [GHSA redacted] (package-lock.json)
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block (.github/workflows/size_report_create.yml)
- Rotate the exposed credentials — git history can't be un-committed