Security Pipeline

Dependabot runs weekly against every package ecosystem in the monorepo: npm for admin, app, www and packages/shared, pip for the API, and monthly for github-actions. Minor and patch updates are grouped per ecosystem so the team gets one PR per package manager per week instead of dozens of one-line bumps. Auto-merge can be enabled for low-risk groups; major version bumps stay manual.

Gitleaks runs on every PR (diff-mode, fast) and on every push to main (incremental over recent history). The rule set is project-tuned beyond the defaults: regex matchers for Stripe live and test keys, Azure connection strings, JWT private keys, Google OAuth client secrets and a generic high-entropy detector at threshold ≥ 4.5. A match blocks the PR; an incident report goes to security@ with the file, line and rule that fired so the human knows exactly what to rotate.

CodeQL covers Python on the API and TypeScript/JavaScript on admin, app, www and packages/shared. It runs on every PR and again every Sunday at 03:00 UTC for full sweeps that catch regressions a fast PR scan might miss. The query suite is security-extended (broader than the GitHub default) so SQL injection, command injection, prototype pollution and SSRF land in the dashboard rather than waiting for a researcher to find them.

Trivy is integrated into deploy-api.yml pre-push: every container image gets scanned before it lands in the Azure Container Registry. The deploy is blocked when Trivy finds a Critical or High CVE that has a fix-version available, on the principle that we should never knowingly deploy a known-fixed vulnerability. A SECURITY_OVERRIDE escape hatch exists for the rare case (third-party dependency with no patch yet, accepted-risk window), and using it auto-notifies #ops-alerts so security leadership cannot miss an override.

The CVE policy in docs/engineering/operations/cve-policy.md formalises the SLA matrix — Critical 48 h, High 7 d, Medium 30 d, Low best-effort — plus the responsible-disclosure pathway via security@petanque.life, the SECURITY_OVERRIDE process and a mandatory retrospective for any Critical incident. The repo-root SECURITY.md publishes the same disclosure policy externally, with scope, SLA and contact, so researchers know how to report safely without scraping the codebase for an email address.