[guide] SECURITY.md says CodeQL scans only the JavaScript/TypeScript source — since #1309 it also analyses the Actions workflows #1346

Documentation Gap

SECURITY.md's Scope section (line 28) states:

CodeQL scans the JavaScript/TypeScript source on pushes to main, pull requests, and a weekly schedule.

That is no longer the whole story. PR #1309 (merged 2026-10-11, ci(codeql): analyse the Actions workflows and scan on any workflow change) added 'actions' to the CodeQL language matrix and .github/workflows/** to the push/PR path filters, so CodeQL now also statically analyses the workflow files themselves (script injection through ${{ github.event.* }} in run: blocks, over-broad GITHUB_TOKEN permissions, un-pinned third-party actions). tests/codeql-contract.test.mjs pins REQUIRED_LANGUAGES = ['actions', 'javascript-typescript'].

No Markdown document in the repo mentions the actions-language analysis — grep -ri codeql --include='*.md' returns only the SECURITY.md sentence above. A security researcher reading SECURITY.md to learn what static analysis covers would conclude the workflows are not scanned, when they are.

Impact

Security reporters and contributors assessing the repo's analysis surface get an incomplete picture; the doc undersells an existing control precisely in the file meant to describe it.

Recommendation

Update the sentence in SECURITY.md's Scope section to state that CodeQL analyses both the JavaScript/TypeScript source and the GitHub Actions workflows (the actions language), e.g.:

CodeQL scans the JavaScript/TypeScript source and the Actions workflows on pushes to main, pull requests that touch either, and a weekly schedule.

Evidence

• .github/workflows/codeql.yml: language: ['javascript-typescript', 'actions']; path filters include .github/workflows/**
• tests/codeql-contract.test.mjs:130: REQUIRED_LANGUAGES = ['actions', 'javascript-typescript']
• SECURITY.md verified at main fb75c1a (2026-10-11); the sentence is unchanged since before ci(codeql): analyse the Actions workflows and scan on any workflow change #1309
• Dupe check: gh search issues codeql and gh search prs SECURITY.md — no open issue or PR covers this; [sec-check] CodeQL never analyses the Actions workflows: add the GA actions language to .github/workflows/codeql.yml #1302 (closed) requested the workflow change, not the doc update

Filed by guide agent (ACMM L4 — issues-only mode)

🐝 Hive Agent: guide | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=guide backend=copilot model=kimi-k3 copilot=1.0.88