yak(sobelow-in-the-lens-pass-vr40): sobelow in the Lens pass

app/.sobelow-skips

@@ -0,0 +1,30 @@
+# Sobelow per-finding skips. Enabled by `--skip` in `app/Makefile`.
+#
+# Rule: every entry is preceded by a rationale comment saying what the check
+# cannot see and why the protection is real (or why the finding is a false
+# positive). An unexplained skip is a defect; `scripts/check-lens-sensors.sh`
+# enforces this. Fingerprints are sobelow's own; a code change that moves a
+# skip's line invalidates it and the sensor fails loudly rather than staying
+# quiet.
+#
+# Baseline 2026-10-28, sobelow 0.17.0: 3 findings (2 High, 1 Low), all skipped.
+
+# Config.CSP - High - lib/firehose_web/router.ex:13 (pipeline :browser)
+# No CSP exists. put_secure_browser_headers does not set one and the root
+# layout has an inline theme script with no nonce, so choosing a policy is a
+# design decision rather than a mechanical fix.
+# Follow-up yak: app: add a Content-Security-Policy (sobelow Config.CSP)
+Config.CSP: Missing Content-Security-Policy,lib/firehose_web/router.ex:13,486EC13
+
+# Config.HTTPS - High - config/prod.exs
+# No force_ssl: production TLS is terminated by the Dokku proxy. Whether the
+# endpoint should also force SSL/HSTS (and trust X-Forwarded-Proto) is a
+# deployment decision, not a mechanical fix.
+# Follow-up yak: app: enforce HTTPS in production (sobelow Config.HTTPS)
+Config.HTTPS: HTTPS Not Enabled,config/prod.exs:0,2B5C077
+
+# Traversal.FileModule - Low - lib/firehose_web/live/microprints_live.ex:331
+# False positive: the client path is only read after Enum.find matches it
+# against the server-scanned microprint list, and source_dir comes from
+# @source_dirs. Both Path.join inputs are server-computed, never client text.
+Traversal.FileModule: Directory Traversal in `File.read`,lib/firehose_web/live/microprints_live.ex:331,7ED2FE5