Security Scanning Subsystem

Scanners: Semgrep (SAST: patterns, OWASP, secrets) and Trivy (SCA: CVEs, secrets, IaC misconfig, licenses). Local or Docker. Profiles: Quick (1 min, high+), Standard (5 min, medium+), Deep (10 min, all). Findings: Stable fingerprint, severity/confidence/category, CWE/OWASP, package/fix info, remediation, SARIF artifact. Management: Installation/uninstallation API, Docker fallback, status monitoring.

---