@camcima/finita 2.0.0 → 2.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Carlos Cima
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -6,7 +6,8 @@
 
 <br>
 
-[![CI](https://github.com/camcima/finita/actions/workflows/ci.yml/badge.svg)](https://github.com/camcima/finita/actions/workflows/ci.yml)
+[![CI](https://github.com/camcima/finita/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/camcima/finita/actions/workflows/ci.yml)
+[![CodeQL](https://img.shields.io/badge/CodeQL-enabled-brightgreen)](https://github.com/camcima/finita/security/code-scanning)
 [![codecov](https://codecov.io/gh/camcima/finita/graph/badge.svg)](https://codecov.io/gh/camcima/finita)
 [![npm version](https://img.shields.io/npm/v/@camcima/finita)](https://www.npmjs.com/package/@camcima/finita)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -188,6 +189,27 @@ src/
   error/                   # Custom error classes
 ```
 
+## Security
+
+### CI
+
+- **CodeQL** -- static analysis for security vulnerabilities (push, PR, weekly)
+- **OSV-Scanner** -- dependency vulnerability scanning against the [OSV database](https://osv.dev/) (push, PR, weekly)
+- **Dependabot** -- automated PRs for dependency and GitHub Actions updates (weekly)
+
+### Local (via Lefthook)
+
+- **Gitleaks** -- scans staged files for secrets on every commit (auto-skipped if not installed)
+
+### Manual checks
+
+```bash
+npm run security:audit    # npm dependency audit
+npm run security:secrets  # Scan full repo for secrets (requires gitleaks)
+```
+
+Install Gitleaks: <https://github.com/gitleaks/gitleaks#installing>
+
 ## Development
 
 ```bash