diff --git a/.github/workflows/codeant.yml b/.github/workflows/codeant.yml
index e6e3c71..a5f67b9 100644
--- a/.github/workflows/codeant.yml
+++ b/.github/workflows/codeant.yml
@@ -14,6 +14,7 @@ jobs:
   codeant_scan:
     name: Run CodeAnt CI scan
     runs-on: ubuntu-latest
+    environment: staging
     if: ${{ vars.CODEANT_ENABLED == 'true' }}
     steps:
       - name: Checkout code
diff --git a/.gitignore b/.gitignore
index 316dd22..44217f2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,7 +2,7 @@
 .env.*
 !.env.example
 
-.sarif
+*.sarif
 
 *node_modules/
 coverage/
diff --git a/README.md b/README.md
index dc1569e..b6e1970 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,6 @@
 # Secure Devtools
 
-Dev-time security tools for detecting compromised code, dependencies, and supply-chain
-risks — designed to run locally and in CI, and to be small enough to audit.
+Dev-time security tools for detecting compromised code, dependencies, and supply-chain risks — designed to run locally and in CI, and to be small enough to audit.
 
 > **Zero npm runtime dependencies.** The shipped tools are plain shell — there is no dependency tree to audit at
 > install time. `am-i-compromised` needs only `bash`, `ripgrep`, and `jq`; `secure-semgrep` also
diff --git a/mise.toml b/mise.toml
index 9248e16..7bbef39 100644
--- a/mise.toml
+++ b/mise.toml
@@ -5,14 +5,13 @@ shellcheck = "latest"
 shfmt = "latest"
 ripgrep = "latest"
 jq = "latest"
-trivy = "latest"
+# trivy = "latest"
 semgrep = "latest"
-snyk = "latest"
 
 [settings]
 minimum_release_age = "7d"
 # pnpm and trivy cut releases frequently enough that the 7d window is not useful.
-minimum_release_age_excludes = ["pnpm", "trivy"]
+minimum_release_age_excludes = ["pnpm"]
 
 # Tasks are thin aliases over the canonical pnpm scripts (package.json) so
 # devs, git hooks, and CI all share one interface. Run with: mise run <task>