v1.12.0 — service security scan, port-forward demo, CVE gating - Security risks: static analyzers over each service spec flag containers pinned to root and credentials embedded in environment variables. A leading 🛡 marks a flagged service in the tree; '!' opens an overlay listing every finding by severity. Only an env var's key name is ever shown, never its value. The analyzer set is an extensible registry. - Site: a second demo slide showing port-forwarding, in a two-slide carousel next to the existing demo. - Security: fixed two reachable CVEs (grpc 1.82.1, x/text 0.39.0) and added a govulncheck CI stage that fails a build on a reachable vulnerability with an available fix. - Docs: the security scan documented and drifted docs corrected (logfmt, the L logs key, ? / --ssh-jump / SWARMEXEC_KEYS, keys.yaml) in all four languages.