No automated dependency vulnerability scanning is configured for the repository

[aadityat23]

Problem

.github/workflows/ contains only backend-tests.yml and sdk-tests.yml. There is no Dependabot configuration, no CodeQL workflow, and no scheduled or PR-triggered vulnerability scan of either the Python (requirements.txt) or JavaScript (package-lock.json) dependency trees.

Why this matters

The project pulls in torch, transformers, peft, and several other packages with active CVE histories, plus a full Next.js/React frontend dependency tree. Without automated scanning, a known vulnerability in a direct or transitive dependency would only be discovered manually — which, in practice, means it wouldn't be discovered at all until something goes wrong.

Acceptance Criteria

• A .github/dependabot.yml is added covering both the Python (pip) and npm ecosystems, with a reasonable update schedule (e.g., weekly)

• A CodeQL analysis workflow is added for both Python and JavaScript/TypeScript

• Both are confirmed to run successfully on a test PR

• SECURITY.md is updated to mention automated scanning is in place

• Documentation updated if necessary

Files likely to modify

.github/dependabot.yml
.github/workflows/codeql.yml
SECURITY.md

Skills required

GitHub Actions, basic security tooling familiarity

Estimated difficulty

2/5

Estimated effort

2–4 hours