Sync from dev ba4c094: Trim ~1,400 lines of doc bloat from public-fac… #117

	# =============================================================================
	# Security Scanning Workflow
	# Runs gitleaks and other security checks on PRs and pushes
	# =============================================================================

	name: Security

	on:
	push:
	branches: [master, main, 1.0.x]
	pull_request:
	branches: [master, main, 1.0.x]
	schedule:
	# Run weekly on Sundays at midnight
	- cron: '0 0 * * 0'

	jobs:
	gitleaks:
	name: Gitleaks Secret Scan
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Install Gitleaks
	run: \|
	curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz \| tar -xz
	chmod +x gitleaks

	- name: Run Gitleaks
	run: \|
	./gitleaks detect --source . --config .gitleaks.toml --verbose

	php-security:
	name: PHP Security Check
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup PHP
	uses: shivammathur/setup-php@v2
	with:
	php-version: '8.3'
	tools: composer

	- name: Check for vulnerable dependencies
	run: \|
	if [ -f "composer.lock" ]; then
	composer audit
	else
	echo "No composer.lock found, skipping audit"
	fi

Provide feedback