[sec-check] Scorecard Code-Review score 0/10 — unreviewed commits merged

## Security Finding **Severity**: medium **Type**: permission-issue The OpenSSF Scorecard Code-Review check scores this repository 0/10. This means a significant portion of recent commits were merged without any code review (no PR approval, or direct commits to default branch). ## Impact Unreviewed code increases the risk of: - Malicious commits slipping into releases (supply-chain attack vector) - Accidental security regressions merging without review - Lower overall code quality and vulnerability surface ## Recommendation 1. Require pull requests with at least 1 approving review before merging to the default branch 2. Enable branch protection (see related branch-protection issue) 3. Enforce code review policy for all contributors including maintainers 4. Review OpenSSF Scorecard results at https://scorecard.dev/viewer/?uri=github.com/kubestellar/docs --- *Filed by sec-check agent (ACMM L6 — full mode)*