CI runs dependency audits for all three packages on every pull request and push to main:

The audit steps currently run with continue-on-error: true (non-blocking) because the dependency trees contain pre-existing findings that require triage. Once triaged and resolved or accepted, the steps will be made blocking by removing continue-on-error.

Tightening path:

1. Resolve or override all current findings (see Triage Process below).
2. Remove continue-on-error: true from the audit steps in .github/workflows/ci.yml.
3. Optionally raise --audit-level to moderate over time.

When an audit finding appears in CI:

• Patch available: Update the dependency immediately.

  # Node.js packages
  npm audit fix
  # or manually update in package.json and npm install
  
  # Rust crates
  cargo update -p <crate>

• No patch available: Evaluate whether the vulnerable code path is reachable. If not, add an npm overrides entry (Node.js) or a [patch] section (Cargo) with a note explaining the accepted risk.

• False positive / Not applicable: Document the finding in the "Accepted Risks" section below with a justification and review date.

After remediation, re-run the audit locally to confirm:

# Backend / Frontend
cd backend && npm audit --audit-level=high
cd frontend && npm audit --audit-level=high

# Contracts
cd contracts && cargo audit

Once all current findings are resolved or formally accepted:

1. Remove continue-on-error: true from the audit steps in .github/workflows/ci.yml.
2. From that point forward, any newly introduced high/critical vulnerability will fail CI.

Populate this table as findings are triaged. Review accepted risks quarterly.

To report a security vulnerability in the application itself (not a dependency), please email the maintainers directly. Do not open a public issue for security vulnerabilities.