- CodeQL: scans JS/TS with security-extended + security-and-quality queries
- cargo-audit: scans Rust dependencies for known CVEs (--deny warnings)
- ShellCheck: lints install.sh and all shell scripts for bugs/vulnerabilities
- Runs on push to master, PRs, and weekly on Mondays at 08:00 UTC