[ARISAWSS]

Summary

• Add a dedicated security_audit/ tooling folder with Bandit/Semgrep JSON helpers (normalize / report / diff), unit tests, and requirements.txt.
• Introduce a new GitHub Actions workflow Security Audit (separate from the existing install CI) that scans TVWeb/app, TVSecure, and TVConnections, generates readable reports, and uploads artifacts.
• Prepare a baseline folder so future runs can fail on new findings once reference JSON files are committed.

Test plan

• Push to ci-security triggers workflow run
• Run #2 (Harden empty SAST output handling.) completed successfully
• Review artifacts on the successful Actions run (Bandit/Semgrep reports)
• Confirm scanned paths are acceptable (TVWeb/app, TVSecure, TVConnections)
• Decide later whether to commit a first baseline under security_audit/baseline/

Made with Cursor