# Retained because the CI scanner is invoked with --config. Findings are
# evaluated transparently by scripts/check-osv-severity.mjs.