# The CVE gate's allowlist (E32). The publish gate scans the built image and the committed tree with
# Trivy and fails on any HIGH or CRITICAL finding that has a fix available. A finding that cannot be
# fixed yet is let through ONLY by an entry here, and every entry carries both:
#   statement   — why it is acceptable for now (what is exposed, what is not)
#   expired_at  — the date it stops being accepted; after it, the gate fails again on its own
# A contract test (frontend/src/lib/gates.contract.test.ts) refuses an entry without either, and
# docs/gates.md lists them.
#
# Example:
#   vulnerabilities:
#     - id: CVE-2026-00000
#       statement: in libfoo's XML path, which nothing in the image calls; no fixed Debian build yet
#       expired_at: 2026-12-31
vulnerabilities: []
secrets: []