John Smith 13cc0847b2 sec: create risk register with all 13 remaining vulns documented ... Each entry has: id, title, package, advisory (GHSA), severity, affected_paths, mitigation, accepted_by, accepted_date, review_by (90 days from accept). When review_by passes, the entry must be re-evaluated: either fixed, accepted again with new review_by, or escalated. Initial entries: 1 critical (decompress, patched locally), 2 high (lodash.pick, svgo via tauri-inliner), 8 moderate, 2 low. All transitive through tauri-inliner or dev-only deps. No production-exploitable paths.		2026-07-24 13:58:19 -04:00
..
risk-register.yaml	sec: create risk register with all 13 remaining vulns documented	2026-07-24 13:58:19 -04:00