# Changelog

## Score

- CAI 55 → 39 (-16.7)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 81 → 61 (-19.9)
- Architecture 85 → 85 (+0.0)
- Maturity 55 → 33 (-21.3)
- Readiness 68 → 43 (-24.8)
- Security 83 → 35 (-48.5)
- Accessibility 44 → 47 (+3.5)

## Resolved (2)

- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block

## New (8)

- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Leaked secret: signing-key (src/Http/Controllers/DarkModeController.php)
- Leaked secret: signing-key (src/Http/Controllers/LockscreenController.php)
- Off-boarding risk: anonymized user #1
- Orphaned file (src/View/Components/Form/Options.php)
- PR-triggered workflow without a permissions block (.github/workflows/quality.yml)
- PR-triggered workflow without a permissions block (.github/workflows/run-tests.yml)