Update review state with new findings and clean area validations

[BodenMcHale]

Summary

This PR updates the code review state tracking to reflect a new critical finding and additional validation areas that have been verified as working correctly.

Key Changes

• Filed new issue [REVIEW] Permissions-Policy tests: 4 assertions broken by merge regression — main branch CI is red #15: Permissions-Policy test regression where 4 assertions are failing in the main branch CI due to a merge conflict between PR test: add comprehensive test coverage + fetch timeout + CLI help/version #2 and PR Add triage state tracking for issue automation #6. The tests expect score 10 for partial/permissive Permissions-Policy values, and the A+ grade boundary fixture is scoring 85% instead of ≥90%.

  • Score: 8.1 (high user impact and evidence quality, moderate security severity)
  • Root cause: PR test: add comprehensive test coverage + fetch timeout + CLI help/version #2's test branch predates PR Add triage state tracking for issue automation #6's strict Permissions-Policy scoring implementation

• Updated runner-up tracking: Clarified that the CSP base-uri duplicate finding references issue [REVIEW] CSP: checkCSP awards full score without verifying base-uri restriction, enabling silent <base> injection bypass #5 which is now closed/resolved

• Added new runner-up finding: Identified vitest devDependency pinning to ^1.6.0 pulling in esbuild ≤0.24.2 with 5 moderate-severity advisories (GHSA-67mh-4wv8-2f99). Not filed due to lower score (4.5), dev-only exposure, and existing dependabot configuration.

• Expanded clean areas validation: Added verification of three additional areas:

  • checkHSTS scoring logic (max-age, includeSubDomains, preload handling)
  • checkCSP unsafe-inline and unsafe-eval detection
  • analyzeHeaders score/maxScore/percentage arithmetic

Notable Details

• Last run timestamp updated to 2026-05-26T01:09:00Z
• All findings include detailed score breakdowns and evidence quality ratings
• Clean areas now comprehensively document validated security header checks

https://claude.ai/code/session_0191nKnNDNNHj7i1wK869jAG