Security scanning

Run every scan below before tagging a release, after changing go.mod, and after touching cookies, EAPI headers, redirects, domain policy, downloads, zlib update, or anything under ~/.config/zlib/. Report each finding with its ID, the affected package or file, whether the code reaches it, and the fixed version. Do not drop findings you judge harmless; mark them instead.

Every commit already runs govulncheck and a staged gitleaks scan through the mandatory pre-commit hook (scripts/check.sh, see .github/CONTRIBUTING.md). The steps below go further: full history, GitHub alerts and the manual review.

1. Go vulnerabilities (govulncheck)

go install golang.org/x/vuln/cmd/govulncheck@v1.9.0
govulncheck ./...
go version   # must match the go line in go.mod