Lattice v1.1.0

What changed

Root SECURITY.md — parameterized SQL, scoped sessions, Markdown href allow-list, guest-post residual risk, no wallet connect
javascript: / data: links in listings render as text; apply URLs must be https:
Guest and authed listing payloads are size-capped; ATS stages and demo-contract flow are enums
Unused template UI packages removed (Radix kit, hookform, date-fns, vaul, zustand, table). Production npm audit --omit=dev is clean
Unit tests for filter URL round-trip, salary cliff math, and href allow-list
Five Playwright Chromium smokes (home, roles, apply form, salaries, URL filters)
GitHub Actions CI on Node 22: unit → typecheck → e2e. Dependabot weekly, majors ignored

git clone https://github.com/devtechedge/lattice.git
cd lattice
npm install
npm test
npm run typecheck
npm run dev

MIT