[abir-vim]

Automated fleet sync of the Vim AppSec Agent. Scans when review starts instead of after every push, skips high-volume deployment/publish bots, supports the centrally configured Sonnet 5 profile, and avoids retrying permanent Bedrock failures. The fail-closed high-severity gate and PR findings comments remain enabled. See scanner-org for the source template.

[github-actions]

Vim AppSec Agent

Passed — findings are below the gate (blocks at high or dependency BLOCK).

Critical	High	Medium	Low	Info	Dep BLOCK	Dep WARN
0	0	0	0	2	0	0

Findings

Info (2)

New dependency-only policy skips Bedrock SAST phases for vim-gitops-app[bot]

• Where: .github/workflows/security.yml:80
• CWE: CWE-693
• Remediation: No change required; the bypass is correctly constrained to a no-code trigger shape. If stricter assurance is desired, additionally assert the diff is empty of content changes (e.g. verify dummy.txt is the only path AND its hunk is trivial) and emit a visible audit log line (already present) so dependency-only runs remain reviewable.

600s debounce on synchronize relies on cancel-in-progress and can delay the verdict

• Where: .github/workflows/security.yml:44
• CWE: CWE-400
• Remediation: Acceptable as-is. If merge latency becomes a concern, shorten the debounce window or move it to a lighter-weight dedicated step; no security remediation needed since the gate remains fail-closed.

---

Gate blocks at severity high or a dependency marked BLOCK.

Questions, false positives, or feedback — ping @abir-vim.