Run cargo audit and npm audit in CI with Hard Failure on Critical Vulnerabilities

[vjuliaife]

Description:
TariffShield processes real financial transactions and stores sensitive importer data, yet no automated vulnerability scanning runs against its dependency trees. Adding cargo audit and npm audit to CI with a hard failure on critical-severity findings ensures that known exploitable vulnerabilities in crate or npm dependencies are caught before they ship, without requiring manual developer intervention.

Acceptance Criteria:

• Create .github/workflows/audit.yml that triggers on pull_request and on a daily schedule: cron: '0 6 * * *' so new CVEs disclosed overnight are caught the next morning
• The cargo-audit step installs cargo-audit via cargo install cargo-audit --locked (cached across runs), runs cargo audit, and fails the job on any advisory with a critical or high CVSS severity
• The npm-audit step runs npm audit --audit-level=critical from the workspace root, which fails on critical vulnerabilities only (high-severity findings generate a warning comment instead)
• Both audit steps upload their JSON output as artifacts (cargo-audit-report.json, npm-audit-report.json) for inspection without rerunning CI
• When the scheduled audit run fails, it opens a GitHub Issue automatically via actions/github-script titled "Security: dependency vulnerability found — " with the CVE IDs and affected packages listed
• A cargo deny configuration (deny.toml) is added alongside cargo audit to enforce license allow-listing (MIT, Apache-2.0, ISC only) and block duplicate crate versions
• Document the vulnerability response process in docs/security.md: how to assess, how to pin or patch, and the SLA for critical fixes (24 hours)

Relevant Files:

• .github/workflows/audit.yml — new audit workflow
• deny.toml — cargo-deny configuration for license and duplicate checks
• Cargo.toml — Rust workspace (crates under audit)
• package.json — npm workspace root (packages under audit)
• docs/security.md — security policy and vulnerability response process

[Legit003]

@Legit003 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I will like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Legit003 to this issue.

[drsteinerdj]

Submitted PR #415 for this: #415

It adds the scheduled/PR dependency audit workflow, npm critical enforcement, Cargo high/critical audit handling, JSON artifacts, scheduled issue creation, deny.toml, and docs/security.md triage/SLA documentation.

[fhayvy]

@fhayvy has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello maintainer, please assign this issue to me. I'll like to contribute to your project.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @fhayvy to this issue.

[drips-wave]

Congratulations, @fhayvy! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @fhayvy: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been completed by @fhayvy as part of the Stellar Wave Program's 6th Wave 🥳

😎 @fhayvy: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.