From 8f8072ffb6b32b10ff6822cf42ec85f0e3317f02 Mon Sep 17 00:00:00 2001
From: ddidderr <ddidderr@paul.network>
Date: Sat, 12 Sep 2026 13:15:28 +0200
Subject: [PATCH] build(security): add locked dependency audit gate

Add one just recipe that scans Cargo.lock with the current RustSec database and deno.lock with Deno's advisory service.

Test Plan:
- just security-audit (no known vulnerabilities; seven RustSec informational warnings)
- just --fmt --check
- git diff --check
---
 justfile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/justfile b/justfile
index dc64477..67cc162 100644
--- a/justfile
+++ b/justfile
@@ -77,6 +77,11 @@ test:
 mdns-vendor-test:
     cargo test --manifest-path vendor/mdns-sd/Cargo.toml --all-targets --all-features
 
+# Check both locked backend and frontend dependency graphs.
+security-audit:
+    cargo audit
+    cd crates/lanspread-tauri-deno-ts && deno audit --lock deno.lock --frozen-lockfile
+
 # Regenerate the committed acceptance catalogs from their fixture packages.
 fixture-catalogs:
     cargo run -p lanspread-compat --bin lanspread-fixture-catalog -- \