Repository navigation

fix: hunt dry-run by default; add --yes opt-in; emit privacy prompt b… #43

	name: Security

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	bandit:
	name: Bandit Security Scan
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"
	- name: Install bandit
	run: pip install bandit
	- name: Scan for security issues
	run: bandit -r scripts/ -ll -x scripts/__init__.py

	dependencies:
	name: Dependency Audit
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"
	- name: Install pip-audit
	run: pip install pip-audit
	- name: Check for vulnerable dependencies
	run: pip-audit -r requirements.txt