SQLMODEL HARDENS SECURITY POSTURE WITH AUTOMATED AUDITING

The update [1] introduces automated security auditing via zizmor, a tool that catches dangerous GitHub Actions patterns that can leak secrets or enable privilege escalation. The team fixed findings across multiple vectors: locked down workflow-level permissions to the principle of least privilege, moved secrets handling to job-level scoping, and configured Dependabot for daily checks with a 7-day cooldown to prevent notification fatigue. They also added pre-commit package ecosystem monitoring, catching transitive dependency risks earlier in the development cycle. The tradeoff is explicit: they ignored the `secrets-outside-env` rule because enforcing it would require approval for every single run, creating friction without meaningful security gain. This is the kind of unglamorous infrastructure work that prevents the class of breaches where a compromised action runner exfiltrates CI secrets.