AI-assisted security review

Separate from code review on a pull request, this is the automated layer that watches thesupply chain continuously:

• Dependabot alerts — flags the outdated Markdown renderer this site's feedback widget depends on, and opens the upgrade PR
• Dependency review — blocks a pull request from introducing a new vulnerable dependency
• Secret scanning with push protection — catches a credential before it's committed, and flags one that already was

Where Copilot Code Review looks at a diff, this layer looks at the whole dependency graph and commit history — the exact surface OWASP's A03: Software Supply Chain Failures is about.