security: track and reconcile remaining OpenSSF Scorecard findings

[jason-allen-oneal]

Objective

Track the remaining OpenSSF Scorecard posture findings.

Pinned snapshot: df6d8f3dc3ea465048153058d1f1f48c93275a7f
Review date: 2026-10-26
Scorecard run: https://github.com/BlueDot-IT/ExploitRank/actions/runs/33341362114

Current controls

main has strict checks, admin enforcement, one required approval, stale-review dismissal, conversation resolution, force-push/deletion prevention, and twelve required CI/CodeQL checks.

Findings

• Alert build(deps): bump the web-dependencies group across 1 directory with 13 updates #9 Maintained — verify automatic closure after the 90-day threshold at 2026-10-24T23:40:23Z.
• Alert build(deps): bump the github-actions group with 13 updates #10 CodeReview — current instance is historical 3/27; preserve mandatory exact-head reviews and recheck the trend.
• Alert fix(deps): remediate web dependency advisories #11 CII Best Practices — assign an owner and complete or explicitly defer badge enrollment.
• Alert fix: remediate dependency and workflow security alerts #13 Fuzzing — keep open; assess API payload, parser, feed-normalization, and ranking/scoring boundaries for recognized fuzzing.

Close only after every item is fixed, superseded by a later scan, or explicitly risk-accepted with evidence.