brand       : vara
version     : 3.27.1
built_at    : 2026-10-25T09:19:21.972Z
file        : index.html
bytes       : 6994898
sha256      : dc3d9b150163ea812d34b25d3d6bfc31e4fe4700cdd31e8543f56a9d98a43fe9
gate_status : PASS

# Public security summary
  npm audit        : critical=0 high=0 moderate=0 low=0
  SBOM scan        : PASSED (anchore/grype 0.120.1, findings 0, blocking 0)
  secret scan      : PASS
  provenance scan  : PASS
  artefact checks  : PASS
  CSP              : present
  network model    : standalone single-file HTML; no Versatile AI Risk Assessment vendor backend
  unsafe-eval      : blocked

# Residual notes
  - CSP uses 'unsafe-hashes' in style-src only, for hash-pinned static style attributes; 'unsafe-inline' and 'unsafe-eval' are not permitted.

# Notes
# Keep SECURITY.txt, RELEASE.txt, SBOM.cdx.json, VEX.cdx.json,
# SHA256SUMS.txt and index.html together for verification.
