Security audit report

@chanmeng666/google-news-server may be integrated with compensating controls: review the 2 high-severity findings below, restrict granted permissions to the minimum the manifest declares, and subscribe to monitoring alerts for score changes.