# vermine2047 Audit Findings

Security audit of `vermine2047` at commit `b1d73e6b08bf`. Each finding links to a detailed write-up (`NNN-*.md`) and a proposed patch (`NNN-*.patch`).

## Summary

**Total findings: 0**

## Findings

## Dropped in adjudication

These findings reproduced in Phase 4 but the Phase 4.5 gate judged them false positives or out of a realistic threat model.

- **Unpinned mutable CI action enabling supply chain hijacking** (high, .gitea/workflows/release.yaml): Malformed URL in `uses` breaks workflow parsing; step is unreachable and prevents execution entirely.; Relies on improbable upstream compromise; standard configuration gap rather than immediate vulnerability.

## Run details

- run id: `aa4595a1`
- commit: `b1d73e6b08bf7ed0157a03137cc3bb50c8d3a26c`
- branch: `main`
- scope: 214 file(s)
- files triaged: 214
- files escalated: 14
- files deep-reviewed: 14
- findings proposed: 1
- findings verified: 0
- findings discarded: 0
- findings dropped in adjudication: 1
- artifacts: 0 written, 0 failed, 0 pending

## How to read this directory

Each finding has a paired `NNN-<slug>.md` (the human report) and `NNN-<slug>.patch` (the proposed fix as a unified diff). The report carries the narrative; the patch is the suggested change. Regenerate a single finding's artifacts with `/audit --regen --finding N`.