First full scan (no docs/security-kb.md yet). 2 High, 3 Medium, 3 Low,
4 Informational findings — most notable: national_id stored/exported in
plaintext despite architecture.md claiming encryption, and a confirmed
CVE (CVE-2026-48019, CVSS 8.9) affecting the installed laravel/framework
12.43.1 via the guest-booking form's Mail::to() call. Report only — no
fixes applied, per the security-scan skill's non-capabilities.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Naser Mansour