# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 57 → 40 (-17.1)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 77 → 56 (-20.8)
- Architecture 88 → 89 (+1.2)
- Maturity 60 → 48 (-11.4)
- Readiness 58 → 61 (+2.1)
- Security 77 → 42 (-35.1)
- Accessibility 47 → 27 (-20.3)
- Performance 100 → 100 (+0.0)

## Resolved (7)

- Further orphaned files (smaller)
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- Medium vulnerability: [GHSA redacted] (yarn.lock)
- Off-boarding risk: anonymized user #1
- Orphaned knowledge (sbt-scastie/src/main/scala/sbt/ScastieTrapExit.scala)
- Workflow token permissions not restricted

## New (55)

- Concentrated knowledge decay
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- Leaked secret: high-entropy-secret (server/src/main/resources/reference.conf)
- Leaked secret: signing-key (server/src/main/resources/reference.conf)
- Medium CVE: [GHSA redacted] (yarn.lock)
- Medium: security finding (details withheld)
- Most significant orphaned file (sbt-scastie/src/main/scala/sbt/ScastieTrapExit.scala)
- Off-boarding risk: anonymized user #1
- Orphaned file (api/src/main/scala/org/scastie/api/ApiModels.scala)
- Orphaned file (balancer/src/main/scala/org/scastie/balancer/DispatchActor.scala)
- Orphaned file (balancer/src/main/scala/org/scastie/balancer/SbtDispatcher.scala)
- Orphaned file (balancer/src/main/scala/org/scastie/balancer/SbtLoadBalancer.scala)
- Orphaned file (balancer/src/main/scala/org/scastie/balancer/StatusActor.scala)
- Orphaned file (client/src/main/scala/org/scastie/client/EventStream.scala)
- Orphaned file (client/src/main/scala/org/scastie/client/RestApiClient.scala)
- Orphaned file (client/src/main/scala/org/scastie/client/Routing.scala)
- Orphaned file (client/src/main/scala/org/scastie/client/components/CodeSnippets.scala)
- …and 35 more

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)