diff --git a/docs/img/code-scanning.jpg b/docs/img/code-scanning.jpg
new file mode 100644
index 0000000..382dee7
Binary files /dev/null and b/docs/img/code-scanning.jpg differ
diff --git a/examples/demo-npm/package-lock.json b/examples/demo-npm/package-lock.json
index 04bec9c..0f874ab 100644
--- a/examples/demo-npm/package-lock.json
+++ b/examples/demo-npm/package-lock.json
@@ -1,8 +1,19 @@
 {
   "name": "patchbot-demo",
   "lockfileVersion": 3,
+  "requires": true,
   "packages": {
-    "": { "name": "patchbot-demo" },
-    "node_modules/lodash": { "version": "4.17.20" }
+    "": {
+      "name": "patchbot-demo",
+      "dependencies": {
+        "lodash": "^4.18.0"
+      }
+    },
+    "node_modules/lodash": {
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
+      "license": "MIT"
+    }
   }
 }
diff --git a/examples/demo-npm/package.json b/examples/demo-npm/package.json
index 468912a..0e514ea 100644
--- a/examples/demo-npm/package.json
+++ b/examples/demo-npm/package.json
@@ -3,6 +3,6 @@
   "private": true,
   "description": "Deliberately vulnerable — used to generate patchbot's own screenshots and CI self-scan findings.",
   "dependencies": {
-    "lodash": "^4.17.20"
+    "lodash": "^4.18.0"
   }
 }