Security Audit: Add comprehensive security audit

[OneByJorah]

Security Audit Gap

Current State: No automated security scanning, no dependency vulnerability scanning, no SAST/DAST tools configured.

Required:

1. Add GitHub Actions workflow with:
   • Dependency vulnerability scanning (Dependabot, Trivy, or similar)
   • Static Application Security Testing (SAST) - Bandit for Python, ESLint Security for JS
   • Container image scanning (Trivy)
   • Secret scanning (GitLeaks, TruffleHog)
2. Add security headers middleware
3. Add CORS strict configuration
4. Add input validation/sanitization
5. Add security logging/audit trail
6. Review authentication/authorization (JWT, password hashing, rate limiting)

Priority: HIGH - Critical for enterprise deployment

[iteebz]

Hey — saw this issue. For the automated scanning piece, you might find repoaudit useful as a quick first pass:

npx github:iteebz/repoaudit

Run it in your repo. It reads your source files and git history, sends them to an AI (needs a free Groq key at console.groq.com), and returns a scored audit with specific findings ordered by severity — secrets, input validation gaps, auth issues, CORS misconfig.

Not a replacement for Dependabot/Trivy on the CI side, but good for getting a prioritized view of what to tackle first. Zero install, runs in 30s.