CodeQL Findings Remediation Hotfix

[Wikid82]

No description provided.

[codecov]

Codecov Report

❌ Patch coverage is 87.35632% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ackend/internal/api/handlers/proxy_host_handler.go	70.00%	3 Missing ⚠️
backend/internal/crowdsec/hub_sync.go	80.00%	3 Missing ⚠️
backend/internal/api/handlers/crowdsec_handler.go	60.00%	2 Missing ⚠️
backend/internal/services/backup_service.go	33.33%	2 Missing ⚠️
backend/internal/crowdsec/hub_cache.go	50.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Aligns local/pre-commit CodeQL JS scanning with CI configuration and expands workflow triggers to cover additional branch patterns, while adding parity checks and documentation for the remediation validation.

Changes:

• Updated JS CodeQL pre-commit scan to use repository root scope and CI Code Scanning config.
• Expanded CodeQL workflow push branch patterns and enforced parity checks for JS tasks/commands.
• Added QA/reporting documentation for the CodeQL hardening validation and alert origin mapping.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
scripts/pre-commit-hooks/codeql-js-scan.sh	Aligns local CodeQL DB creation with CI scope and config.
scripts/ci/check-codeql-parity.sh	Updates parity assertions for workflow branches and VS Code JS task wiring.
.github/workflows/codeql.yml	Expands push triggers to include feature/fix branch patterns.
.vscode/tasks.json	Switches JS CodeQL task to call the shared pre-commit script.
docs/reports/qa_report.md	Documents validation steps/results for the CodeQL hardening.
docs/reports/codeql_pr718_origin_map.md	Adds a report mapping high alerts to introducing commits.

[github-actions]

⚠️ Supply Chain Verification Results

⚠️ WARNING

📦 SBOM Summary

• Components: 1674

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	1
🟡 Medium	9
🟢 Low	1
Total	11

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.