diff --git a/.github/workflows/artcraft-linux-publish.yml b/.github/workflows/artcraft-linux-publish.yml
index e76cc04ac4..1ba4a98027 100644
--- a/.github/workflows/artcraft-linux-publish.yml
+++ b/.github/workflows/artcraft-linux-publish.yml
@@ -80,7 +80,7 @@ jobs:
         working-directory: frontend
       - run: ./node_modules/.bin/nx run artcraft:build
         working-directory: frontend
-      - uses: tauri-apps/tauri-action@fce9c6108b31ea247710505d3aaaa893ee6768d4 # v0
+      - uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0
         with:
           projectPath: crates/desktop/artcraft
           args: --target ${{ matrix.target }} --bundles ${{ matrix.bundles }} --config ${{ github.workspace }}/packaging/linux/tauri.conf.json
diff --git a/.github/workflows/artcraft-macos-publish.yml b/.github/workflows/artcraft-macos-publish.yml
index 59ca9a9532..712452c766 100644
--- a/.github/workflows/artcraft-macos-publish.yml
+++ b/.github/workflows/artcraft-macos-publish.yml
@@ -46,7 +46,7 @@ jobs:
           node-version: lts/*
 
       - name: install Rust stable
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           targets: ${{ matrix.platform == 'macos-latest-xlarge' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
@@ -72,7 +72,7 @@ jobs:
           npm cache clean --force
 
           echo "Installing all workspace dependencies..."
-          npm ci
+          npm ci --ignore-scripts
 
           echo "=== Version Information ==="
           echo "Node version:"
@@ -205,9 +205,8 @@ jobs:
           # Increase Node.js memory limit for the build
           export NODE_OPTIONS="--max-old-space-size=8192"
 
-          # Use npx to ensure we use the local nx version
-          echo "Building with npx nx..."
-          npx nx run artcraft:build
+          echo "Building with nx..."
+          ./node_modules/.bin/nx run artcraft:build
 
           echo "Checking build output..."
           # shellcheck disable=SC2012
@@ -226,7 +225,7 @@ jobs:
 
 
       - name: build and publish
-        uses: tauri-apps/tauri-action@v0
+        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
diff --git a/.github/workflows/artcraft-windows-publish.yml b/.github/workflows/artcraft-windows-publish.yml
index cb07d151a7..46763d34c6 100644
--- a/.github/workflows/artcraft-windows-publish.yml
+++ b/.github/workflows/artcraft-windows-publish.yml
@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: install Rust stable
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
 
       - name: install wreq dependencies
         run: |
@@ -61,7 +61,7 @@ jobs:
           npm cache clean --force
 
           echo "Installing all workspace dependencies..."
-          npm ci
+          npm ci --ignore-scripts
 
           echo "=== Version Information ==="
           echo "Node version:"
@@ -101,7 +101,7 @@ jobs:
           $config | ConvertTo-Json -Depth 10 | Set-Content tauri.conf.json
 
       - name: build and publish
-        uses: tauri-apps/tauri-action@v0
+        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0
         env:
           # NB(bt): This is needed by wreq. Hopefully it doesn't kill Tauri
           RUSTFLAGS: "-C target-feature=+crt-static"
diff --git a/frontend/api_docs.html b/frontend/api_docs.html
index a5c0ebb87b..6631f88bd9 100644
--- a/frontend/api_docs.html
+++ b/frontend/api_docs.html
@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta name="description" content="SwaggerUI" />
     <title>Storyteller API</title>
-    <link rel="stylesheet" href="//unpkg.com/swagger-ui-dist@5.32.0/swagger-ui.css" />
+    <link rel="stylesheet" href="https://unpkg.com/swagger-ui-dist@5.32.0/swagger-ui.css" integrity="sha384-3nuX7df3EaAoiqLBeyS1Ola0Gpg9ryJKVtarubwfnA1cOH8AWHUdbPSIvEqPZ9VH" crossorigin="anonymous" />
   </head>
   <body>
 
 		<div id="swagger-ui"></div>
 
-		<script src="//unpkg.com/swagger-ui-dist@5.32.0/swagger-ui-bundle.js" crossorigin></script>
-		<script src="//unpkg.com/swagger-ui-dist@5.32.0/swagger-ui-standalone-preset.js" crossorigin></script>
+		<script src="https://unpkg.com/swagger-ui-dist@5.32.0/swagger-ui-bundle.js" integrity="sha384-7xcoc6ZKDFF7Ek627QTC3Bg/K+5Y36NJ8MWAE43D2m6+3Sh9XO3tdsfHhrS8gNIQ" crossorigin="anonymous"></script>
+		<script src="https://unpkg.com/swagger-ui-dist@5.32.0/swagger-ui-standalone-preset.js" integrity="sha384-FjFI+0PRyd5aAEoduVmUYk65iDC5+onNzam4WJtbAKKBim/kWvGUMk/2+9qRaYZb" crossorigin="anonymous"></script>
 		<script>
 			window.onload = () => {
 				window.ui = SwaggerUIBundle({
diff --git a/frontend/build_modules.sh b/frontend/build_modules.sh
index f5300d54ae..075e1612e8 100755
--- a/frontend/build_modules.sh
+++ b/frontend/build_modules.sh
@@ -17,7 +17,7 @@ set -euxo pipefail
 echo 'TEMPORARY HACK: Build internal dependencies of artcraft since nx is not finding them...'
 
 # A 'clean' will remove nx
-npm install
+npm install --ignore-scripts
 
 # TODO: Temp commented out
 nx build "@storyteller/api"
diff --git a/packaging/linux/package-test.sh b/packaging/linux/package-test.sh
index 3b2b63af76..a5f4c1daac 100755
--- a/packaging/linux/package-test.sh
+++ b/packaging/linux/package-test.sh
@@ -37,11 +37,11 @@ rpmbuild --define "_topdir $work/rpmbuild" -bb rpmbuild/SPECS/artcraft.spec
 find rpmbuild/RPMS -name '*.rpm' -exec cp {} target/x86_64-unknown-linux-gnu/release/bundle/rpm/ \;
 printf 'appimage fixture\n' > target/x86_64-unknown-linux-gnu/release/bundle/appimage/ArtCraft.AppImage
 "$script" x86_64 x86_64-unknown-linux-gnu
-for format in deb rpm AppImage AppImage.zsync tar.gz; do test -s "dist/release/artcraft-0.42.0-linux-x86_64.$format"; done
+for format in deb rpm AppImage AppImage.zsync tar.gz; do [[ -s "dist/release/artcraft-0.42.0-linux-x86_64.$format" ]]; done
 mkdir unpacked
 tar -xzf dist/release/artcraft-0.42.0-linux-x86_64.tar.gz -C unpacked
-test -x unpacked/artcraft-0.42.0-linux-x86_64/bin/artcraft
-test -f unpacked/artcraft-0.42.0-linux-x86_64/share/applications/ai.artcraft.app.desktop
+[[ -x unpacked/artcraft-0.42.0-linux-x86_64/bin/artcraft ]]
+[[ -f unpacked/artcraft-0.42.0-linux-x86_64/share/applications/ai.artcraft.app.desktop ]]
 rm target/x86_64-unknown-linux-gnu/release/bundle/rpm/*.rpm
 if "$script" x86_64 x86_64-unknown-linux-gnu; then
   echo 'Packaging accepted a missing RPM' >&2
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index 3ff5dbb177..9ecbe694a1 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -31,7 +31,7 @@ if [[ "${desktops[0]}" != "$work/$base/share/applications/ai.artcraft.app.deskto
 fi
 install -Dm644 "$script_dir/ai.artcraft.app.metainfo.xml" "$work/$base/share/metainfo/ai.artcraft.app.metainfo.xml"
 sed -i 's/^Name=.*/Name=ArtCraft Studio/' "$work/$base/share/applications/ai.artcraft.app.desktop"
-test -x "$work/$base/bin/artcraft"
+[[ -x "$work/$base/bin/artcraft" ]]
 case "$arch" in
   x86_64) machine='Advanced Micro Devices X86-64' ;;
   aarch64) machine='AArch64' ;;
diff --git a/script/artcraft/unix_build.sh b/script/artcraft/unix_build.sh
index 8c15eee668..ad84f870c3 100755
--- a/script/artcraft/unix_build.sh
+++ b/script/artcraft/unix_build.sh
@@ -15,7 +15,7 @@ config_path="${rust_crate_path}/tauri.conf.json"
 
 pushd "${frontend_path}" || exit
 
-npm install --verbose
+npm install --ignore-scripts --verbose
 
 popd || exit
 
diff --git a/script/artcraft/unix_dev.sh b/script/artcraft/unix_dev.sh
index 074f7128e4..f75cd85a32 100755
--- a/script/artcraft/unix_dev.sh
+++ b/script/artcraft/unix_dev.sh
@@ -38,7 +38,7 @@ fi
 cd "${frontend_path}"
 if [[ ! -f node_modules/vite/package.json ]]; then
   # Do not use the legacy install helper: its failure recovery deletes caches.
-  npm install
+  npm install --ignore-scripts
 fi
 
 exec node "${frontend_path}/scripts/unix-dev.mjs"
diff --git a/script/artcraft/unix_frontend_production_build.sh b/script/artcraft/unix_frontend_production_build.sh
index b1e6fad14f..0092826f79 100755
--- a/script/artcraft/unix_frontend_production_build.sh
+++ b/script/artcraft/unix_frontend_production_build.sh
@@ -9,7 +9,7 @@ echo ""
 
 pushd "${frontend_path}" || exit
 
-npm install --verbose
+npm install --ignore-scripts --verbose
 
 export VITE_ENVIRONMENT_TYPE="production"
 
diff --git a/script/artcraft/unix_frontend_production_preview.sh b/script/artcraft/unix_frontend_production_preview.sh
index aeee33c73e..beea8d5836 100755
--- a/script/artcraft/unix_frontend_production_preview.sh
+++ b/script/artcraft/unix_frontend_production_preview.sh
@@ -20,7 +20,7 @@ fi
 
 pushd "${frontend_path}" || exit
 
-npm install --verbose
+npm install --ignore-scripts --verbose
 
 export VITE_ENVIRONMENT_TYPE="production"
 
diff --git a/script/common/frontend_preflight.sh b/script/common/frontend_preflight.sh
index a260e5940b..a0fb53cd3b 100755
--- a/script/common/frontend_preflight.sh
+++ b/script/common/frontend_preflight.sh
@@ -16,7 +16,7 @@ FRONTEND_MINIMUM_NODE_MAJOR=20
 frontend_preflight() {
   local frontend_path="$1"
 
-  if [ ! -d "${frontend_path}" ]; then
+  if [[ ! -d "${frontend_path}" ]]; then
     echo "ERROR: frontend directory not found at: ${frontend_path}"
     echo "Run this script from the repository root."
     exit 1
@@ -40,7 +40,7 @@ frontend_preflight() {
   # --- Node must be recent enough for Nx 21 / Vite 6 ---
   local node_major
   node_major=$(node --version | sed -E 's/^v([0-9]+).*/\1/')
-  if [ "${node_major}" -lt "${FRONTEND_MINIMUM_NODE_MAJOR}" ]; then
+  if [[ "${node_major}" -lt "${FRONTEND_MINIMUM_NODE_MAJOR}" ]]; then
     echo "ERROR: Node.js ${FRONTEND_MINIMUM_NODE_MAJOR}+ is required (found $(node --version))."
     echo "Upgrade via nvm ('nvm install --lts') or https://nodejs.org."
     exit 1
@@ -50,13 +50,13 @@ frontend_preflight() {
   # pnpm was briefly adopted ("add pnpm to solve build issues") and then dropped
   # ("fix(frontend): consume video-editor libs via nx path aliases, drop pnpm").
   # A node_modules tree written by pnpm makes npm fail with ENOTEMPTY errors.
-  if [ -e "${frontend_path}/pnpm-lock.yaml" ] \
-      || [ -e "${frontend_path}/pnpm-workspace.yaml" ] \
-      || [ -d "${frontend_path}/node_modules/.pnpm" ]; then
+  if [[ -e "${frontend_path}/pnpm-lock.yaml" ]] \
+      || [[ -e "${frontend_path}/pnpm-workspace.yaml" ]] \
+      || [[ -d "${frontend_path}/node_modules/.pnpm" ]]; then
     echo "ERROR: Stale pnpm artifacts detected in ${frontend_path}."
     echo "The frontend uses npm (pnpm was dropped; see frontend/README.md)."
     echo "Clean up with:"
-    echo "  cd ${frontend_path} && rm -rf node_modules pnpm-lock.yaml pnpm-workspace.yaml && npm install"
+    echo "  cd ${frontend_path} && rm -rf node_modules pnpm-lock.yaml pnpm-workspace.yaml && npm install --ignore-scripts"
     exit 1
   fi
 }
@@ -66,7 +66,7 @@ frontend_preflight() {
 # layout causing ENOTEMPTY rename errors), wipe node_modules and the nx cache
 # and retry once before giving up.
 frontend_npm_install() {
-  if npm install; then
+  if npm install --ignore-scripts; then
     return 0
   fi
 
@@ -77,7 +77,7 @@ frontend_npm_install() {
 
   rm -rf node_modules .nx
 
-  if ! npm install; then
+  if ! npm install --ignore-scripts; then
     echo ""
     echo "ERROR: npm install failed again. See the npm output above and the"
     echo "troubleshooting section in frontend/README.md."
diff --git a/sonar-project.properties b/sonar-project.properties
index 025f9e3cd0..c03af40790 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -6,3 +6,26 @@ sonar.organization=storytold
 # as filmcraft and lightcraft excluding tools/docs/examples.
 sonar.coverage.exclusions=**/*.ts,**/*.tsx,**/*.js,**/*.jsx
 
+
+# Not analysed: code that isn't ArtCraft's or isn't run by the app or CI.
+# - crates/vendor/: third-party crates kept in the tree.
+# - The Python beside the Grok and Sora clients: the upstream reference implementations the Rust ports
+#   cite ("Based on Grok-Api/core/xctid.py"); nothing runs them.
+# - frontend/scripts/unix-dev.mjs and frontend/tools/performance/: developer tools run by hand
+#   (script/artcraft/unix_dev.sh, `npm run perf:desktop`); they start git, cargo and a browser from
+#   the developer's own PATH and write where the developer says.
+sonar.exclusions=crates/vendor/**,crates/api_clients/grok_consumer_client/src/credentials/_metadata/**,crates/api_clients/openai_sora_client/src/requests/auth_sentinel_2/metadata/python_impl/**,frontend/scripts/unix-dev.mjs,frontend/tools/performance/**
+
+# S4347 (predictable seed): DeterministicRng is the fixed-seed generator for tests and dev seed
+# tools; being reproducible is its purpose.
+# S2187 (file without tests): the API tests build their cases with the shared helpers in
+# test/app/Classes/ApiManager/utils/, which call `it` themselves.
+# S2819 (message origin): a dedicated worker's `message` events come only from the page that
+# started it; they carry no origin to check.
+sonar.issue.ignore.multicriteria=deterministic_rng,api_test_helpers,worker_messages
+sonar.issue.ignore.multicriteria.deterministic_rng.ruleKey=rust:S4347
+sonar.issue.ignore.multicriteria.deterministic_rng.resourceKey=crates/schema/public/tokens/src/deterministic_rng.rs
+sonar.issue.ignore.multicriteria.api_test_helpers.ruleKey=typescript:S2187
+sonar.issue.ignore.multicriteria.api_test_helpers.resourceKey=frontend/apps/artcraft/test/app/Classes/ApiManager/**
+sonar.issue.ignore.multicriteria.worker_messages.ruleKey=typescript:S2819
+sonar.issue.ignore.multicriteria.worker_messages.resourceKey=**/*.worker.ts