chore: add OWASP.WTF security scan

[jeremyjs]

Summary

Adds a zero-config OWASP.WTF security scan to this repo.

What it does:

• Runs on every push and PR to main
• Scans with Semgrep, Gitleaks, and Trivy (gracefully skips any that aren't available)
• Maps all findings to OWASP Top 10 2021 categories
• Fails the workflow on any high or critical finding
• Uploads results to GitHub code scanning (Security tab → Code scanning alerts)

How it works:
Uses the DecOperations/OWASP.WTF composite GitHub Action.

This workflow uses ${{ github.token }} by default — no additional secrets needed for DecOperations repos.

Test plan

• Workflow triggers on next push/PR
• Security tab shows scan results (may be empty on first clean run)
• If findings are detected, they appear as code scanning alerts

---

Opened by the OWASP.WTF daily rollout — DecOperations/OWASP.WTF

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
depot-builder	Ready	Preview, Comment	May 21, 2026 6:47pm