feat: add Snyk dependency scanning and Netlify deployment config

.github/workflows/snyk.yml

@@ -0,0 +1,70 @@
+name: 🔒 Snyk
+
+# Dependency vulnerability scanning.
+#
+# Runs as its own workflow rather than a job inside CI, matching how this repo
+# already separates concerns (lint.yml, typecheck.yml, main.yml, chromatic.yml
+# are each one file). Concretely it needs a different trigger gate, a different
+# secret, and has different failure semantics from a build — folding it into
+# main.yml would mean a security finding reads as "the build broke".
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: snyk-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  security:
+    name: Dependency scan
+    runs-on: ubuntu-latest
+
+    # GitHub does not expose secrets to pull_request runs from forks, and
+    # almost every contribution here comes from one. Without this gate SNYK_TOKEN
+    # would be empty on those runs and the job would fail red on contributor PRs
+    # through no fault of theirs — the same trap the Vercel check falls into.
+    # main still gets scanned on every push.
+    if: >-
+      github.event_name == 'push' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      # ── Why this step exists ────────────────────────────────────────────────
+      # This project uses bun, and its lockfile is the newer text-format
+      # `bun.lock`. Snyk's Node scanner resolves dependency trees from
+      # package-lock.json, yarn.lock or pnpm-lock.yaml — bun.lock is not a
+      # supported target file, so `snyk test` would either scan nothing useful
+      # or fall back to package.json ranges, which cannot pin transitive
+      # versions and therefore misses most real vulnerabilities.
+      #
+      # `--package-lock-only` writes a lockfile from package.json without
+      # installing anything or running scripts. It is generated fresh here and
+      # never committed — package-lock.json is in .gitignore, and CLAUDE.md
+      # forbids committing it, since bun.lock remains the source of truth.
+      - name: Generate a lockfile Snyk can parse
+        run: npm install --package-lock-only --ignore-scripts
+
+      - name: Run Snyk
+        uses: snyk/actions/node@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          # High and critical only, so the first run is actionable rather than
+          # a wall of low-severity transitive noise. Lower it once the backlog
+          # is clean.
+          args: --severity-threshold=high --file=package-lock.json

.snyk

@@ -0,0 +1,18 @@
+# Snyk policy file — https://docs.snyk.io/snyk-cli/commands/policy
+#
+# Controls how Snyk treats specific vulnerabilities in this project.
+#
+# Deliberately empty of ignores. Every finding surfaces until someone decides
+# otherwise, and each exception should be added here explicitly, with a reason
+# and an expiry, so it can be reviewed rather than forgotten:
+#
+#   ignore:
+#     SNYK-JS-EXAMPLE-123456:
+#       - '*':
+#           reason: Not reachable — dev-only transitive dep, no runtime path
+#           expires: 2026-12-31T00:00:00.000Z
+#
+# `patch` is unused: this project has no Snyk-patchable dependencies.
+version: v1.25.0
+ignore: {}
+patch: {}

README.md

@@ -37,12 +37,19 @@
   <a href="https://gssoc.girlscript.tech">
     <img src="https://img.shields.io/badge/GSSoC-2026-FF6B35?style=flat-square">
   </a>
-  <a href="https://github.com/Sneha079-codes/reframe/actions/workflows/main.yml">
-    <img src="https://github.com/Sneha079-codes/reframe/actions/workflows/main.yml/badge.svg">
+  <a href="https://github.com/magic-peach/reframe/actions/workflows/main.yml">
+    <img src="https://github.com/magic-peach/reframe/actions/workflows/main.yml/badge.svg">
+  </a>
+  <a href="CODE_OF_CONDUCT.md">
+    <img src="https://img.shields.io/badge/Code%20of%20Conduct-v2.1-purple?style=flat-square">
+  </a>
+</p>
+
+<p align="center">
+  <a href="https://www.netlify.com">
+    <img src="https://www.netlify.com/assets/badges/netlify-badge-color-accent.svg" alt="Deploys by Netlify" width="114" height="50">
   </a>
 </p>
-<<<<<<< HEAD
-=======
 
 </div>
 
@@ -58,7 +65,6 @@
 ![FFmpeg](https://img.shields.io/badge/FFmpeg.wasm-0.12.10-green?style=flat-square&logo=ffmpeg)
 ![Lucide](https://img.shields.io/badge/Lucide_React-latest-orange?style=flat-square)
 ![Lottie](https://img.shields.io/badge/Lottie_Web-latest-purple?style=flat-square)
->>>>>>> f3b7ebeac4ae0b71305509eb79f9285c952b467a
 
 </div>