Add scheduled security scan workflow

README.md

@@ -60,6 +60,7 @@ Use only the files that fit the project. For a tiny script repo, `AGENTS.md`, `R
 | `files/AGENTS.md` | `AGENTS.md` |
 | `files/project.md` | `.codex/project.md` |
 | `files/build-gitea.yml` | `.gitea/workflows/build.yml` |
+| `files/security-scan-gitea.yml` | `.gitea/workflows/security-scan.yml` |
 | `files/release-checklist.md` | `docs/release-checklist.md` |
 | `files/security-review.md` | `docs/security-review.md` |
 | `files/blueprint.md` | `blueprint.md` |
@@ -123,6 +124,7 @@ When applying this kit, an agent should:
 - keep `AGENTS.md` and `.codex/project.md` aligned,
 - update `README.md` whenever README blueprint files change,
 - update security and release docs when release behavior changes,
+- add or preserve scheduled security automation for releasable projects,
 - update `docs/agent-handoff.md` when work is interrupted, risky, or multi-session,
 - run `git diff --check` before finishing,
 - run the cheapest reliable verification command,
@@ -130,6 +132,21 @@ When applying this kit, an agent should:
 
 <p align="center"><img src="https://raw.githubusercontent.com/andreasbm/readme/master/assets/lines/rainbow.png" alt="-----------------------------------------------------" width="100%"></p>
 
+## Scheduled Security Automation
+
+`files/security-scan-gitea.yml` provides an optional weekly Gitea workflow for releasable projects.
+
+It checks:
+
+- stack-specific dependency vulnerabilities,
+- suspicious code patterns,
+- committed secrets or local config files,
+- AI instruction-injection indicators.
+
+The workflow is intentionally conservative. If it fails, an agent should inspect the matches and decide whether they are real risks, documentation examples, or test fixtures. Do not silence the workflow without documenting why.
+
+<p align="center"><img src="https://raw.githubusercontent.com/andreasbm/readme/master/assets/lines/rainbow.png" alt="-----------------------------------------------------" width="100%"></p>
+
 ## Gitea API Token
 
 When working with private repositories on `git.wilkensxl.de`, Codex agents may find a local `GITEA_TOKEN` environment variable on the machine.