brand       : vara
version     : 3.27.1
built_at    : 2026-10-25T09:45:23.267Z
file        : index.html
bytes       : 4417767
sha256      : b78395d86ecd30329c2ef952ee92879e7ce7acfa96eedb6b0e6a5202677f28cd
gate_status : PASS

# Public security summary
  npm audit        : critical=0 high=0 moderate=0 low=0
  SBOM scan        : PASSED (anchore/grype 0.120.1, findings 0, blocking 0)
  secret scan      : PASS
  provenance scan  : PASS
  artefact checks  : PASS
  CSP              : present
  network model    : standalone single-file HTML; no Versatile AI Risk Assessment vendor backend
  unsafe-eval      : blocked

# Residual notes
  - CSP uses 'unsafe-hashes' in style-src only, for hash-pinned static style attributes; 'unsafe-inline' and 'unsafe-eval' are not permitted.

# Notes
# Keep SECURITY.txt, RELEASE.txt, SBOM.cdx.json, VEX.cdx.json,
# SHA256SUMS.txt and index.html together for verification.
