security-scan

name	security-scan
description	Run all project security scans (make security) and summarize findings by tool and severity

Run make security from the project root. This executes:

• govulncheck ./... — Go vulnerability database check
• gosec ./... — Go static security analysis
• trivy fs . --severity HIGH,CRITICAL — filesystem vulnerability scan
• gitleaks detect --source . --verbose — secrets detection

For each tool, summarize:

• Count of findings by severity (CRITICAL, HIGH, MEDIUM, LOW)
• Full details for any CRITICAL or HIGH findings: file:line, rule ID, description, remediation

Final verdict:

• CLEAN: no HIGH or CRITICAL findings across all tools
• NEEDS ATTENTION: list specific items requiring action, ordered by severity