- **Problem Statement.** `ci.yml` builds, lints, and tests but does not flag CVEs in crates. - **Why it matters.** Faster CVE detection, less churn. - **Expected Outcome.** Add a `contracts-audit` job running `cargo audit` and `cargo deny check`. - **Acceptance Criteria.** 1. CI fails on HIGH/CRITICAL advisories. 2. `deny.toml` committed with allow-list. - **Files / Modules.** `.github/workflows/ci.yml`, `contracts/deny.toml`. - **Dependencies.** `cargo-audit`, `cargo-deny`. - **Difficulty.** Easy. - **Effort.** 0.5 day. - **Labels.** `security`, `ci`, `contracts`, `good first issue`. ## Frontend UX & Accessibility
ci.ymlbuilds, lints, and tests but doesnot flag CVEs in crates.
contracts-auditjob runningcargo auditandcargo deny check.deny.tomlcommitted with allow-list..github/workflows/ci.yml,contracts/deny.toml.cargo-audit,cargo-deny.security,ci,contracts,good first issue.Frontend UX & Accessibility