From 3f740f30e025f473e953df2e4d0d5eb2dcedbfa3 Mon Sep 17 00:00:00 2001
From: AHReccese <amirhssin6rst@gmail.com>
Date: Sun, 12 Jul 2026 21:42:35 -0400
Subject: [PATCH 1/2] add SAST & SCA scans

---
 .github/workflows/security.yml | 52 ++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 .github/workflows/security.yml

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..a7e3899
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,52 @@
+name: Security
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+
+  pull_request:
+    branches:
+      - dev
+      - main
+
+env:
+  SCAN_PYTHON_VERSION: '3.9'
+
+permissions:
+  contents: read
+
+jobs:
+  codeql:
+    name: CodeQL (SAST)
+    runs-on: ubuntu-22.04
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python ${{ env.SCAN_PYTHON_VERSION }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.SCAN_PYTHON_VERSION }}
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: python
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+
+  dependency-review:
+    name: Dependency Review (SCA)
+    runs-on: ubuntu-22.04
+    # dependency-review-action requires a PR base ref to diff against
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4

From 05ea15160a270f543f8578e18d873c688711cc9d Mon Sep 17 00:00:00 2001
From: AHReccese <amirhssin6rst@gmail.com>
Date: Sun, 12 Jul 2026 21:42:39 -0400
Subject: [PATCH 2/2] `CHANGELOG.md` updated

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index be07abe..1bd6044 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,9 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- CodeQL (SAST) scan
+- Dependency Review (SCA) scan
 ## [0.8] - 2026-05-27
 ### Changed
 - `upload` method in `uploader.py`