Localz — GitHub Advanced Security for the CI/CD gap

Projects/Localz.md §5 names the CI/CD path as GitHub Actions → ECR → Argo CD (or GH Actions direct to EKS), and §6's two security docs (Minimal-to-Production-Security-Implementation.md, Secure-Communication-Design.md) are exhaustive on application-level security — rate limiting, CAPTCHA, virus-scanning uploads, encryption, consent/audit trails — but neither mentions repo- or pipeline-level security: no code scanning, no dependency/CVE scanning, no secret-scanning gate anywhere in the stated CI/CD plan.

• Tools/GitHub_Advanced_Security — GitHub-native SAST (CodeQL (unresolved)) + SCA (Dependabot (unresolved)) + secret scanning, added to the vault 2026-08-13. Since Localz's CI/CD already runs on GitHub Actions, this isn't a new vendor to integrate — it's a repo settings/workflow toggle on infrastructure already chosen, not a Snyk-style third-party addition requiring its own onboarding.

Why this is ready now, not just adjacent: Localz's own anti-lock-in principle #3 requires an abstraction layer only for Auth/Storage/Payments/Notifications/Search — CI/CD tooling isn't on that list, so there's no architectural reason to defer this. It also fits the "Phase 0" cost- conscious posture (§6): GHAS's code/secret scanning is free on public repos and low-cost on private ones, cheaper than the Snyk alternative also on file in this vault.

Suggested next step: add CodeQL default setup + secret scanning + push protection to the Localz repo now (pre-Phase-1, before the codebase grows), and add Dependabot once the Week 4+ dependency surface (Stripe, Clerk/Keycloak SDKs) is in place. No blocking unknowns — this is fully actionable today.