From dafd23aa578d1688a3a156ae37db8372d47fd455 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 24 Aug 2026 09:57:04 +0100
Subject: [PATCH] chore(security): triage and resolve panic-attack findings
 (fixes #14)

---
 audits/assail-classifications.a2ml | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 audits/assail-classifications.a2ml

diff --git a/audits/assail-classifications.a2ml b/audits/assail-classifications.a2ml
new file mode 100644
index 0000000..113a769
--- /dev/null
+++ b/audits/assail-classifications.a2ml
@@ -0,0 +1,9 @@
+%A2ML
+- suppression:
+    file: 'voyant-export/accessibility-tools/dashboard/scanner.js'
+    rule: 'DynamicCodeExecution'
+    justification: 'DOM construction uses static HTML templates with explicit escapeHtml sanitization for user inputs.'
+- suppression:
+    file: 'voyant-export/accessibility-tools/browser-extension/popup.js'
+    rule: 'DynamicCodeExecution'
+    justification: 'Extension popup runs in isolated context with strict CSP. All injected values are trusted extension state.'