# Repository guidance

- Security scanning (GitLeaks, Trivy, Semgrep) is centralized in `COMPU-VISION/security-workflow` and invoked from `.github/workflows/deploy.yml` as a single reusable `security.yml` job. This repository no longer has its own local scanner workflows, Semgrep rules, or report-generation scripts.
- Application-specific scanner config that still lives here: `.github/gitleaks.toml` (GitLeaks rules/allowlists) and `.github/.gitleaksignore` (acknowledged historical findings). The central `gitleaks.yml` reads both from this repository's own checkout.
- To validate or change Semgrep rules, rulesets, the ignore policy, or the report generator, work in `COMPU-VISION/security-workflow` (`semgrep/`, `scripts/`, `report/`) - see that repository's README.