Security Program & Scanning

How you keep the software highly secure over time - secure SDLC, CI scanning, threat model, runtime defenses, IR, and compliance.

How you keep the software highly secure over time: a secure SDLC, automated scanning in CI, a threat model, runtime defenses, incident response, and the compliance posture (ISO 27001 / SOC 2).

Secure SDLC (shift left)

Every change passes through scanning before it can deploy (enforced in CI, 52):

Stage	Tool class	Blocks merge on
Pre-commit	secret scanning (gitleaks/trufflehog)	any credential in the diff
PR / CI	SAST (CodeQL/Semgrep)	high-severity code findings
PR / CI	SCA / dependency (Dependabot, `npm audit`, OSV-Scanner, Snyk)	known-vuln deps
PR / CI	IaC scan (tfsec/Checkov)	misconfigured Terraform (public buckets, open firewalls)
Build	container scan (Trivy/Grype on the image)	critical OS/lib CVEs
Build	image signing (cosign / Binary Authorization)	unsigned images can't deploy
Pre-release	DAST (OWASP ZAP against staging)	high-severity runtime findings
Continuous	dependency + image re-scan on a schedule	newly-disclosed CVEs

Binary Authorization on Cloud Run/GKE ensures only signed, scanned images run in prod.

Threat model (what we defend against)

Cross-tenant data access → silo + RLS + policy engine + negative tests (43).
Prompt injection / data exfiltration via the LLM → evidence-as-data, propose-only write tools, citation validation (32).
Credential theft → per-tenant secrets, least-privilege service accounts, rotation, no secrets in code/logs (42).
Broken authz → central policy engine, server-side enforcement, audit of privileged actions (41).
Supply chain → pinned deps, SCA, SBOM, signed images.
DoS / noisy neighbor → per-tenant compute, rate limits, Cloud Armor / WAF at ingress.
Insider / operator misuse → break-glass consent + audit, separation of control-plane roles (§17, 41).

Maintain a living threat model (STRIDE per service) in the repo; review on architecture changes.

Runtime defenses

Cloud Armor / WAF at the edge (OWASP rule set, rate limiting, geo/IP rules).
TLS everywhere, HSTS, strict CORS, secure cookies, CSP on the frontend.
Input validation at every boundary (zod/schema); parameterized queries only (no string SQL).
Audit logging append-only; ship logs to a tamper-evident sink; alert on anomalies (mass export, off-hours break-glass).
Least-privilege IAM; Workload Identity (no long-lived SA keys).

Vulnerability management & pen testing

Triage SLA by severity (e.g. critical 24h, high 7d, medium 30d).
Annual third-party penetration test (scope includes tenant-escape, authz bypass, LLM abuse) + remediation tracking.
A responsible-disclosure / bug-bounty intake.
SBOM generated per build; track and patch transitive deps.

Incident response

Runbooks: data-exposure, credential compromise, tenant-isolation breach, dependency 0-day.
On suspected tenant compromise: rotate that tenant's secrets, suspend the instance (§17), preserve audit logs, notify per contractual SLAs.
Post-incident review with action items; blameless.

Compliance posture

Target ISO 27001 (audit scheduled — see the marketing/security page) and SOC 2 Type II.
Controls map to what's already built: per-claim provenance, append-only audit, exportable machine-readable trace, single-tenant isolation, data residency per region (infra/50).
Data-protection: DPAs, sub-processor list, per-tenant residency, GDPR data-subject export/delete flows.

Gaps to close

Pick the concrete tools (CodeQL vs Semgrep, Snyk vs OSV, etc.) and wire them into Cloud Build (52).
Stand up Binary Authorization + cosign signing.
Write the threat model per service and the IR runbooks; schedule the first pen test.
Decide the compliance timeline and assign control owners.