docs: Vulnerability Assessment Report for ixa Framework

[devin-ai-integration]

docs: Add Vulnerability Assessment Report for ixa Framework

Summary

Adds a comprehensive vulnerability assessment report (VULNERABILITY_ASSESSMENT.md) to the repository root. The assessment was performed using cargo audit, Snyk SAST, and manual review of CI/CD pipelines, Dockerfile, and code patterns.

14 findings total: 0 critical, 1 high (transitive bytes crate integer overflow), 4 medium (unpinned GH Actions, unmaintained deps, unpinned Docker base image), 5 low, 4 informational. A prioritized remediation matrix and prevention recommendations are included.

No code changes—this is a documentation-only PR.

Review & Testing Checklist for Human

• Verify FINDING-01 is still current: Run cargo audit locally to confirm the bytes v1.10.1 advisory (RUSTSEC-2026-0007) hasn't already been resolved by a recent Cargo.lock update
• Assess severity ratings against your threat model: The report rates the bytes overflow as HIGH, but the web_api feature is optional and localhost-only—confirm this severity is appropriate for your deployment context
• Note: Snyk SCA scan did not complete — the folder trust step hung, so Software Composition Analysis was not included. Consider running snyk test manually for full dependency coverage
• Spot-check CI/CD findings (FINDING-04, FINDING-10): Verify the unpinned action references and the bench-compare.yaml script injection claim by reviewing the actual workflow files
• Decide on report placement: Confirm VULNERABILITY_ASSESSMENT.md in the repo root is the desired location (vs. docs/ or a separate security tracking system)

Notes

• The Snyk Code Scan (SAST) completed cleanly with 0 issues. The IaC scan found no IaC files, which is expected for a pure Rust project.
• The report includes a remediation priority matrix (P0–P4) and 7 future prevention recommendations (e.g., integrating cargo audit into CI).

Requested by: @charityquinn-cognition
Link to Devin Session

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring