[carbon-evolution]

Summary

Updates the OWASP Top 10:2025 ratings in SECURITY.md after the fixes merged today.

#	Category	Before	After	Why
A01	Broken Access Control	🟠 Medium	🟢 Low	#51: recon scanner closed by default (access token / explicit opt-in); client IP from forwarding headers only with TRUST_PROXY_HEADERS
A02	Security Misconfiguration	🟠 Medium	🟠 Medium (improved)	#52: Permissions-Policy, COOP/CORP, no X-Powered-By, CSP without unsafe-eval and with fallback directives. ZAP still reports 3 Medium (unsafe-inline script/style, wildcard media sources), so it stays Medium
A06	Insecure Design	🟠 Medium	🟢 Low	#50: analytics opt-in, visitor-IP event removed; recon no longer anonymous
A09	Logging and Alerting	🟠 Medium	🟠 Medium	unchanged: no runtime alerting, no audit_log retention policy

Overall: 2 Medium, 8 Low (was 4 Medium, 6 Low). No High.

Evidence (from main at 5a24bcf)

• OWASP ZAP (CI run on main): 0 High · 3 Medium · 1 Low · 4 Informational; 62 rules passed (was 0 / 5 / 5 / 5, 60 passed)
• OpenSSF Scorecard: 8.0 / 10 (was 6.2)
• CI, CodeQL, malware scan and Scorecard all green on main

Next steps that would lower the remaining Mediums

• A02: move map-popup inline onclick handlers to addEventListener, then adopt CSP nonces to drop script-src 'unsafe-inline'.
• A09: alerting on rate-limit / scanner-auth failures; a retention policy for audit_log (stores client IPs).

🤖 Generated with Claude Code