docs: create 5 priority security architecture issues for security-architect agent

[Copilot]

Pull Request Description

Created 5 GitHub issues for security architecture improvements per Secure Development Policy requirements, assigned to security-architect agent.

Type of Change

• 📝 Documentation
• 🔒 Security & Compliance

Component(s) Modified

• App Core
• Dashboard
• Radar Chart
• Security Level Widget
• Business Impact Analysis Widget
• Compliance Status Widget
• Cost Estimation Widget
• Security Summary Widget
• Value Creation Widget
• Constants / Data Model
• Hooks

CIA Impact Area

• Confidentiality
• Integrity
• Availability

Security Level Impact

• Basic
• Moderate
• High
• Very High

Test Coverage Impact

• My changes affect low-coverage areas (SecurityLevelWidget, RadarChart, CostEstimation, useCIAOptions)
• I've added tests to improve coverage
• N/A - Only modifying high-coverage areas

Testing Performed

• Manual testing completed
• Security validation performed

Screenshots/Examples

N/A - GitHub issues created

Related Issues

Creates the following issues:

• 🔐 Automate OWASP ZAP security scanning in CI/CD pipeline #615 - Automate OWASP ZAP security scanning in CI/CD pipeline
• 🛡️ Add AWS Control Tower objectives (CO.1-CO.15) evidence to SECURITY_ARCHITECTURE.md #617 - Add AWS Control Tower objectives (CO.1-CO.15) evidence to SECURITY_ARCHITECTURE.md
• ⚡ Integrate automated Lighthouse performance audits with security gates #616 - Integrate automated Lighthouse performance audits with security gates
• 📊 Enhance security evidence badge portfolio with testing results #618 - Enhance security evidence badge portfolio with testing results
• 🎯 Expand THREAT_MODEL.md with STRIDE attack trees and MITRE ATT&CK mappings #619 - Expand THREAT_MODEL.md with STRIDE attack trees and MITRE ATT&CK mappings

Checklist

• My PR title follows the conventional commit format (e.g., feat: add new feature)
• Code follows project coding standards
• Tests are passing
• Documentation has been updated (if applicable)
• Security compliance is maintained or improved
• Changes have been reviewed for performance impact
• Breaking changes are documented (if any)

Additional Notes

Issues Created:

#	Title	Priority	Effort	Labels
#615	🔐 Automate OWASP ZAP scanning	High	S (2-3h)	security, compliance:iso27001, compliance:nist, priority:high, infrastructure
#617	🛡️ Add AWS Control Tower CO.1-CO.15	High	M (4-6h)	documentation, security, compliance:iso27001, compliance:nist, priority:high
#616	⚡ Lighthouse performance audits	High	S (2-3h)	performance, infrastructure, compliance:iso27001, priority:high
#618	📊 Enhance security badge portfolio	Medium	S (1-2h)	documentation, security, compliance:iso27001, priority:medium
#619	🎯 Expand THREAT_MODEL.md	Medium	M (4-6h)	documentation, security, compliance:iso27001, priority:medium

Key Gaps Identified:

• ZAP scan exists but manual-only (workflow_dispatch) - needs automation per Policy §7
• SECURITY_ARCHITECTURE.md missing CO.1-CO.15 control objective evidence per Policy §11
• Lighthouse audits manual-only - needs PR triggers and performance gates per Policy §8
• Security badge portfolio incomplete - missing test results, ZAP, Lighthouse badges
• THREAT_MODEL.md needs attack tree expansion with MITRE ATT&CK mappings

Baseline Metrics:

• Test Coverage: 75.06% line, 64.9% branch (below 80%/70% targets)
• Bundle Size: ~201 KB gzipped (within 500 KB budget)
• Security Docs: SECURITY_ARCHITECTURE.md (66KB), THREAT_MODEL.md exist but need enhancement

All issues include accurate metrics, implementation guidance with file paths, and reference existing policy requirements.

Original prompt

create top 5 prio issues to be assigned to https://github.com/Hack23/.github-private/blob/main/agents/security-architect.md

Custom agent used: hack23-task-agent
Expert in repository analysis and task decomposition, creating prioritized, small, mergeable GitHub issues from architecture, code, and documentation analysis

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.