brand       : vara
version     : 3.27.1
built_at    : 2026-10-25T09:20:16.844Z
file        : index.html
bytes       : 6727752
sha256      : ffadc122679b0710fa89c0b496569f00cfa6ffdd85cc1a1c921511c0707d1588
gate_status : PASS

# Public security summary
  npm audit        : critical=0 high=0 moderate=0 low=0
  SBOM scan        : PASSED (anchore/grype 0.120.1, findings 0, blocking 0)
  secret scan      : PASS
  provenance scan  : PASS
  artefact checks  : PASS
  CSP              : present
  network model    : standalone single-file HTML; no Versatile AI Risk Assessment vendor backend
  unsafe-eval      : blocked

# Residual notes
  - CSP uses 'unsafe-hashes' in style-src only, for hash-pinned static style attributes; 'unsafe-inline' and 'unsafe-eval' are not permitted.

# Notes
# Keep SECURITY.txt, RELEASE.txt, SBOM.cdx.json, VEX.cdx.json,
# SHA256SUMS.txt and index.html together for verification.
