feat(quality): add security and accessibility gates

Author: ericyangpan

.github/workflows/ci.yml

@@ -97,6 +97,25 @@ jobs:
       - name: Run CSpell
         run: npm run spell
 
+  security:
+    name: Dependency Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Block high and critical advisories
+        run: npm run security:audit
+
   build:
     name: Build
     runs-on: ubuntu-latest
@@ -156,7 +175,7 @@ jobs:
   ci-success:
     name: CI Success
     runs-on: ubuntu-latest
-    needs: [lint, type-check, test, spell-check, build, e2e]
+    needs: [lint, type-check, test, spell-check, security, build, e2e]
     if: always()
     steps:
       - name: Check all jobs

SECURITY.md

@@ -81,7 +81,7 @@ If you're contributing to this project, please follow these security guidelines:
 
 ### Current Architecture
 
-AI Coding Stack is a static Next.js website deployed on Cloudflare Pages:
+AI Coding Stack is a mostly static Next.js website deployed on Cloudflare Workers:
 
 - **No user authentication**: The site doesn't handle user credentials
 - **No user data collection**: We don't store personal information
@@ -97,7 +97,8 @@ AI Coding Stack is a static Next.js website deployed on Cloudflare Pages:
 
 2. **Dependency vulnerabilities**: npm packages may have vulnerabilities
    - Mitigation: Dependabot automatic updates
-   - Regular security audits with `npm audit`
+   - CI blocks high and critical advisories across production and development dependencies
+   - Run the same audit locally with `npm run security:audit`
 
 3. **XSS risks**: User-contributed content could introduce XSS
    - Mitigation: All content is sanitized and validated
@@ -147,6 +148,16 @@ If you're deploying AI Coding Stack, ensure:
 - Configure CSP (Content Security Policy)
 - Enable DDoS protection
 
+## Dependency Audit Policy
+
+- Dependabot checks npm and GitHub Actions dependencies every Monday.
+- Pull requests and `main` pushes run `npm run security:audit` against the official npm advisory
+  service.
+- High and critical advisories block CI. Moderate and low advisories require documented triage and
+  should be resolved in the next compatible dependency update.
+- Security upgrades should stay within supported framework and adapter ranges; do not accept an
+  automated downgrade solely to reduce the audit count.
+
 ## Contact
 
 For security concerns or questions not covered here:

docs/PROJECT-REVIEW-2026-07-18.md

@@ -95,10 +95,10 @@ Baseline captured on 2026-07-18:
 - [x] Add route-contract tests for every manifest category.
 - [x] Add browser-level smoke tests for search, navigation, detail pages, locale switching, and
   comparison selection.
-- [ ] Add automated accessibility checks for dialogs, menus, comparison tables, and mobile nav.
+- [x] Add automated accessibility checks for dialogs, menus, comparison tables, and mobile nav.
 - [x] Run generation in CI and fail when tracked generated output differs.
 - [x] Make the aggregate CI job fail on cancelled or skipped required jobs as well as failures.
-- [ ] Add a small security workflow/policy for dependency and application review.
+- [x] Add a small security workflow/policy for dependency and application review.
 
 ## P2 — Architecture and Scale
 
@@ -177,3 +177,10 @@ evidence; completed items are reflected in the checklists and implementation log
   guard requiring future manifest changes to be represented in `data/changelogs.json`.
 - Fixed the search result category badge to use the shared translated category names after browser
   testing exposed a missing runtime message lookup.
+- Upgraded Next.js, OpenNext Cloudflare, next-intl, React, Vitest, Wrangler, and AJV to compatible
+  patched releases; refreshed vulnerable transitives and reduced `npm audit` from 42 advisories to
+  zero without accepting automated framework downgrades.
+- Added a required high/critical dependency-audit CI job and documented the security triage policy.
+- Added Axe browser checks for the search dialog, language menu, model comparison tables, and
+  expanded mobile navigation, fixing the accessible names, ARIA relationships, decorative content,
+  and contrast issues those checks exposed.

next.config.ts

@@ -36,6 +36,8 @@ const securityHeaders = [
 const nextConfig: NextConfig = {
   pageExtensions: ['js', 'jsx', 'md', 'mdx', 'ts', 'tsx'],
 
+  allowedDevOrigins: ['localhost'],
+
   // Required for OpenNext Cloudflare adapter
   output: 'standalone',
 
@@ -140,16 +142,20 @@ const nextConfig: NextConfig = {
           },
         ],
       },
-      // Aggressive caching for Next.js static assets
-      {
-        source: '/_next/static/:path*',
-        headers: [
-          {
-            key: 'Cache-Control',
-            value: 'public, max-age=31536000, immutable',
-          },
-        ],
-      },
+      ...(process.env.NODE_ENV === 'production'
+        ? [
+            // Development assets must remain revalidatable for hydration and HMR.
+            {
+              source: '/_next/static/:path*',
+              headers: [
+                {
+                  key: 'Cache-Control',
+                  value: 'public, max-age=31536000, immutable',
+                },
+              ],
+            },
+          ]
+        : []),
       // Cache images and media files
       {
         source: '/images/:path*',