# Oshun V1 Release Security Gates

The V1 release gate combines repository automation and external security
activities.

Repository gates:

- CodeQL and SAST in `.github/workflows/codeql.yml` and
  `.github/workflows/ci.yml`.
- Dependency vulnerability checks through
  `scripts/security/dependency-audit/v1-launch-audit.mjs` in
  `.github/workflows/security-deps-and-secrets.yml` and the release workflow.
  The gate blocks high-or-critical findings on the Oshun/Metis V1 launch surface
  and fails on new high-or-critical non-launch monorepo findings unless they are
  reviewed into
  `docs/security/dependency-audit/non-v1-known-high-critical.json`.
- Secret scanning through Gitleaks and TruffleHog in
  `.github/workflows/security-deps-and-secrets.yml`.
- SBOM and provenance artifacts through `.github/workflows/sbom-and-sign.yml`.
- Release signing where package substrate supports it.
- Production BFF auth rejects local `dev.` bearer tokens and requires signed
  JWTs with configured issuer/audience validation.
- Fuzz and malicious-input suites for uploads, imports, markdown, rich text,
  search, prompt/tool surfaces, and webhooks.
- API inventory and shadow-endpoint discovery run in strict mode against
  `docs/security/api-inventory/oshun-bff-endpoints.json` as a pre-release check
  in `.github/workflows/release.yml`.

External gates:

- Authenticated DAST against staging web, admin, and launch-critical APIs.
- Pre-GA penetration test and red-team exercise covering auth, RBAC, privacy,
  Metis, grounded generation, and admin escalation paths.

Security signoff is recorded only when all repository gates are green and the
external report has no unresolved release-blocking findings. The release
workflow verifies that record with `scripts/security/pentest/verify-signoff.mjs`
before publishing.