security: track and reconcile remaining OpenSSF Scorecard findings

[jason-allen-oneal]

Objective

Track the remaining non-vulnerability OpenSSF Scorecard posture findings.

Pinned snapshot: e2a4790c323b85f249dee62c75d1fc620844251c
Review date: 2026-10-26
Scorecard run: https://github.com/BlueDot-IT/GhostMCP/actions/runs/33341365560

Current controls

main has strict checks, admin enforcement, one required approval, stale-review dismissal, conversation resolution, linear history, and force-push/deletion prevention.

Findings

• Alert Schedule Codex Security scan weekly #8 Maintained — verify automatic closure after the 90-day threshold at 2026-10-24T23:40:11Z.
• Alert ci: enforce hash-locked dependency installation #7 CodeReview — current instance is historical 6/29; preserve mandatory exact-head reviews and recheck the trend.
• Alert ci: retire broken per-repository Codex scan #9 CII Best Practices — assign an owner and complete or explicitly defer badge enrollment.
• Alert fix(deps): update cryptography to patched release #10 Fuzzing — keep open; assess protocol parsers, scanner inputs, tool-policy documents, and transport boundaries for recognized fuzzing.

Alert #12 Vulnerabilities is excluded from governance acceptance. It remains open pending merge of #12 and a successful post-merge Scorecard scan.