Context: Launch Readiness Assessment flagged Security as Yellow. Complete these before GA. Moved from PRODUCT-1918.

Tasks

• SSDLC baseline: Complete the SSDLC baseline for the package (threat model, security review, documented controls).
• Release signing: Sign published npm tarballs and artifacts in the release pipeline.
• Vulnerability scanning: Onboard the repo to the DevProd Vulnerability Scanning platform for third-party dependency scanning.
• Papertrail: Integrate releases with the DevProd Papertrail service to record who published each release.

Done when: All four are in place and Product Security has signed off, so the LRA Security status can move to Green.

https://github.com/mongodb-developer/vercel-ai-memory