ci: remove broken OWASP Dependency-Check job (redundant with Trivy)

The advisory OWASP Dependency-Check job failed on every run ("JAVA_HOME is not defined
correctly" inside the action's container, and no NVD API key), leaving a permanent red check on
every commit and Dependabot PR despite continue-on-error. It is redundant with the enforced Trivy
SCA gate (same Maven dependencies, passing) and Dependabot updates, so removing it yields a fully
green, non-redundant security pipeline: CodeQL, Semgrep, Trivy, gitleaks, find-sec-bugs, Dependabot.
Docs (README, SECURITY.md, CHANGELOG, security assessment) updated to match.

Author: MILTONADINA

.github/workflows/security.yml

@@ -86,34 +86,3 @@ jobs:
           exit-code: '1'
           ignore-unfixed: true
           skip-dirs: target
-
-  owasp-dependency-check:
-    name: OWASP Dependency-Check (advisory)
-    runs-on: ubuntu-latest
-    # Advisory: the NVD feed can rate-limit without an API key, so this job reports but does not gate.
-    # Add an NVD_API_KEY repository secret to make it reliable. Trivy (above) is the enforced SCA gate.
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up JDK 17
-        uses: actions/setup-java@v4
-        with:
-          java-version: '17'
-          distribution: 'temurin'
-          cache: maven
-      - name: Dependency-Check
-        uses: dependency-check/Dependency-Check_Action@1.1.0
-        with:
-          project: point-of-sale
-          path: '.'
-          format: 'HTML'
-          args: >-
-            --failOnCVSS 7
-            --nvdApiKey ${{ secrets.NVD_API_KEY }}
-      - name: Upload report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: dependency-check-report
-          path: ${{ github.workspace }}/reports
-          if-no-files-found: ignore

CHANGELOG.md

@@ -21,8 +21,8 @@ layered application.
 - Confirmed all bundled seed data is **synthetic** (non-issuable SSNs, fictional `555` phone numbers,
   a masked demo card and check account).
 - Added an **empirically-verified security pipeline** (`.github/workflows/security.yml`): CodeQL,
-  Semgrep, Trivy, gitleaks, advisory OWASP Dependency-Check, plus **find-sec-bugs** in the `mvn verify`
-  gate and **Dependabot** — currently a zero-finding pass.
+  Semgrep, Trivy, and gitleaks, plus **find-sec-bugs** in the `mvn verify` gate and **Dependabot** —
+  currently a zero-finding pass.
 
 ### Fixed / correctness
 - Corrected **date-based price selection** so promotional prices apply only within their window and

README.md

@@ -201,9 +201,9 @@ masked to the last four digits and never written to disk. The bundled data is en
 this project is an educational demo that must not handle real cardholder data.
 
 Security is verified empirically, not assumed: a dedicated [security workflow](.github/workflows/security.yml)
-runs **CodeQL**, **Semgrep**, **Trivy** + **OWASP Dependency-Check**, and **gitleaks** on every push,
-complemented by **find-sec-bugs** in the `mvn verify` build gate (CI) and **Dependabot** watching
-dependencies — currently a clean, zero-finding pass. Full details, the threat model, and how to report a
+runs **CodeQL**, **Semgrep**, **Trivy**, and **gitleaks** on every push, complemented by
+**find-sec-bugs** in the `mvn verify` build gate (CI) and **Dependabot** watching dependencies —
+currently a clean, zero-finding pass. Full details, the threat model, and how to report a
 vulnerability are in [SECURITY.md](SECURITY.md).
 
 ## License

SECURITY.md

@@ -68,7 +68,7 @@ on every push and pull request, and weekly on a schedule; they can all be run lo
 |-------|------|----------------|
 | SAST (Java) | **CodeQL** (`security-extended`) + **find-sec-bugs** (SpotBugs plugin, in `mvn verify`) | injection, crypto misuse, path traversal, unsafe deserialization, weak randomness |
 | SAST (rules) | **Semgrep** (`p/java`, `p/security-audit`, `p/secrets`) | OWASP-style code patterns |
-| Dependencies (SCA) | **Trivy** (enforced) + **OWASP Dependency-Check** (advisory) | known CVEs in third-party libraries |
+| Dependencies (SCA) | **Trivy** (enforced) | known CVEs in third-party libraries |
 | Secrets | **gitleaks** | committed credentials/keys |
 | Supply chain | **Dependabot** | outdated/vulnerable dependencies and actions |
 

docs/SECURITY-ASSESSMENT.md

@@ -127,8 +127,8 @@ scope/ethics grounds.
 - **SAST** — Semgrep (124 rules across `p/java`, `p/security-audit`, `p/secrets`): **0 findings**.
   SpotBugs + find-sec-bugs (build gate): **0 bugs**. CodeQL `security-extended` (CI): **0 alerts**.
 - **SCA** — Trivy over the dependency set (sole runtime dependency: **LGoodDatePicker**; JUnit and
-  spotbugs-annotations are test/provided): **0 HIGH/CRITICAL CVEs**. OWASP Dependency-Check runs as
-  an advisory CI job.
+  spotbugs-annotations are test/provided): **0 HIGH/CRITICAL CVEs**, enforced in CI. Dependabot
+  watches for new dependency and GitHub Actions updates.
 - **Secrets** — gitleaks across the working tree: **0 leaks**. Bundled seed data is synthetic
   (non-issuable SSNs, `555` phone numbers, a single *masked* card record).
 - **Credential storage** — salted PBKDF2-HMAC-SHA256 @ 600,000 iterations, PHC-encoded, constant-time
@@ -156,4 +156,4 @@ semgrep scan --config p/java --config p/security-audit --config p/secrets src/
 ```
 
 See [SECURITY.md](../SECURITY.md) for the threat model and the standing CI security pipeline
-(CodeQL, Semgrep, Trivy, gitleaks, OWASP Dependency-Check, Dependabot).
+(CodeQL, Semgrep, Trivy, gitleaks, Dependabot).