l3montree-dev devguard

• CVE-2026-48089 High 7.1 DevGuard has improper authorization on public assets 0.4%
• CVE-2026-42300 Critical 9.3 DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header 0.3%