chore(security): weekly scan 2026-07-13 — all clear

[cursor]

Weekly Security Scan — 2026-07-13

Repository: pocketrocket/floatify
Mode: weekly-cron
Agent branch: cursor/weekly-security-scan-e6c0

Scan results

Check	Result	Details
pnpm audit --audit-level=moderate	✅ Pass	No known vulnerabilities in dependency tree
gitleaks detect	✅ Pass	58 commits scanned, no leaks found
snyk test --severity-threshold=high	⚠️ Skipped	SNYK_TOKEN not configured on this environment
Open Dependabot PRs	—	None open

Findings & actions

• No vulnerabilities requiring fixes at moderate severity or above.
• No committed secrets detected.
• No open Dependabot PRs to triage or skip.
• No issues created — nothing requires manual review.

Infrastructure improvement

main still lacked a committed lockfile, blocking pnpm audit and --frozen-lockfile installs. This PR adds pnpm-lock.yaml (eslint ^9.39.0 devDependency tree, 86 packages) and documents dev/audit commands in README.md.

Note: Draft PR #32 (cursor/weekly-security-scan-1d3b) proposed the same lockfile change from the 2026-07-06 scan. This PR supersedes it with an updated weekly report.

Dependency notes (informational)

Package	Current	Latest	Action
eslint (dev)	9.39.5	10.7.0	Major bump — ignored by Dependabot config; no security advisory

Recommendations

1. Merge this PR to enable reproducible dependency audits on main.
2. Configure SNYK_TOKEN as a repo secret to enable Snyk scans in future weekly runs.
3. Close draft PR chore: add pnpm-lock.yaml for reproducible dependency audits #32 as superseded.

---

Outcome: ✅ All clear — no security fixes required this week.