brand       : vara
version     : 3.27.1
built_at    : 2026-10-25T09:44:56.732Z
file        : index.html
bytes       : 5788844
sha256      : b4e010c36151f02fb911250c905ae667978a2ff78aae717dfa7a1d29a2a376d8
gate_status : PASS

# Public security summary
  npm audit        : critical=0 high=0 moderate=0 low=0
  SBOM scan        : PASSED (anchore/grype 0.120.1, findings 0, blocking 0)
  secret scan      : PASS
  provenance scan  : PASS
  artefact checks  : PASS
  CSP              : present
  network model    : standalone single-file HTML; no Versatile AI Risk Assessment vendor backend
  unsafe-eval      : blocked

# Residual notes
  - CSP uses 'unsafe-hashes' in style-src only, for hash-pinned static style attributes; 'unsafe-inline' and 'unsafe-eval' are not permitted.

# Notes
# Keep SECURITY.txt, RELEASE.txt, SBOM.cdx.json, VEX.cdx.json,
# SHA256SUMS.txt and index.html together for verification.
