Dependabot was logging warnings on every PR because the configured
labels (frontend, backend, dependencies, etc.) don't exist as GitHub
labels in this repository. Removing them stops the noise.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- SECURITY.md with vulnerability disclosure policy and self-hosting guidance
- Dependabot config for weekly dependency updates (npm, Docker, Actions)
- ESLint v9 flat config for frontend and backend, with eslint-plugin-security
- GitHub Actions CI: lint, typecheck, build, and npm audit on every push/PR
- CodeQL workflow for automated security scanning (runs on push and weekly)
2GT-RichandClaude Sonnet 4.6