security-notes.md

Security Notes

Audit Policy

CI runs:

npm audit --omit=dev --audit-level=high

High and critical advisories fail the pipeline.

Current Documented Exception

At the time of this refactor, next still pulls in a moderate postcss advisory through its own dependency tree. The automated npm audit fix --force path offered by npm is a breaking downgrade and is therefore not appropriate.

Current handling:

• severity: moderate
• source: transitive postcss under next
• visibility: still shown by npm audit
• CI impact: non-blocking until an upstream-safe upgrade path exists

This exception should be revisited whenever Next.js is upgraded.