Disciplines · Security

Oshun V1 Release Security Gates

Security policies, hardening, and incident response.

0sections1 minread
Markdown source
On this page

The V1 release gate combines repository automation and external security activities.

Repository gates:

  • CodeQL and SAST in .github/workflows/codeql.yml and .github/workflows/ci.yml.
  • Dependency vulnerability checks through scripts/security/dependency-audit/v1-launch-audit.mjs in .github/workflows/security-deps-and-secrets.yml and the release workflow. The gate blocks high-or-critical findings on the Oshun/Metis V1 launch surface and fails on new high-or-critical non-launch monorepo findings unless they are reviewed into docs/security/dependency-audit/non-v1-known-high-critical.json.
  • Secret scanning through Gitleaks and TruffleHog in .github/workflows/security-deps-and-secrets.yml.
  • SBOM and provenance artifacts through .github/workflows/sbom-and-sign.yml.
  • Release signing where package substrate supports it.
  • Production BFF auth rejects local dev. bearer tokens and requires signed JWTs with configured issuer/audience validation.
  • Fuzz and malicious-input suites for uploads, imports, markdown, rich text, search, prompt/tool surfaces, and webhooks.
  • API inventory and shadow-endpoint discovery run in strict mode against docs/security/api-inventory/oshun-bff-endpoints.json as a pre-release check in .github/workflows/release.yml.

External gates:

  • Authenticated DAST against staging web, admin, and launch-critical APIs.
  • Pre-GA penetration test and red-team exercise covering auth, RBAC, privacy, Metis, grounded generation, and admin escalation paths.

Security signoff is recorded only when all repository gates are green and the external report has no unresolved release-blocking findings. The release workflow verifies that record with scripts/security/pentest/verify-signoff.mjs before publishing.