Pillar — Security & Access Control

Prefix: SEC- What it measures: protection from accidents and from malice — committed-secret hygiene, dependency auditing, CODEOWNERS routing, branch protection, contribution provenance (DCO), automated dependency updates, response headers, and SBOM-on-release.

Branch protection prevents force-pushes and direct merges to main. Secret scanning catches the occasional committed credential. Dependency scanning catches the occasional vulnerable package. CODEOWNERS routes PRs to the right reviewers. At L4 and above, SBOM and supply-chain provenance become expected.

Criteria in this pillar

SEC-010 — No committed secrets

Level: 1 · Scope: repository · Check: deterministic
gitleaks (or trufflehog) scan of the full git history returns zero findings of API keys, tokens, private keys, or passwords.
Rationale: a leaked secret in history is a rotation emergency; agents must never author one.
Evidence expected: .gitleaks.toml present; CI runs gitleaks; zero findings.

SEC-020 — `.env*` gitignored

Level: 1 · Scope: repository · Check: deterministic
.gitignore excludes .env, .env.local, .env.*.local, *.pem, *.key, service-account*.json, .aws/.
Rationale: default-deny on sensitive files is the cheapest single control.
Evidence expected: .gitignore contents.

SEC-030 — Dependency audit gate

Level: 2 · Scope: repository · Check: deterministic
CI runs pnpm audit --prod (or equivalent) and fails on HIGH or CRITICAL findings.
Rationale: known-vulnerable dependencies in production are a preventable class of incident; agents pulling new deps must know the bar.
Evidence expected: CI step; failure behavior confirmed.

SEC-040 — CODEOWNERS present

Level: 2 · Scope: repository · Check: deterministic
CODEOWNERS exists at repo root and assigns at least one owner to the entire tree.
Rationale: ownership routes review to the right person; unreviewed changes are the most common regression source.
Evidence expected: CODEOWNERS file present; syntax valid.

SEC-050 — Branch protection on `main`

Level: 3 · Scope: repository · Check: manual
main requires pull request review, passing CI, and no force-push. Documented in SECURITY.md or inferable from GitHub API.
Rationale: without branch protection, a compromised agent or account can land unreviewed code.
Evidence expected: GitHub branch protection rules; documentation acknowledging them.

SEC-060 — DCO or equivalent contribution gating

Level: 3 · Scope: repository · Check: deterministic
Every commit to main contains a Signed-off-by trailer (DCO), or repository policy requires a CLA. Enforced via CI check.
Rationale: contribution provenance matters for legal and trust reasons; machine-checkable enforcement is cheap.
Evidence expected: commits on main inspected; DCO action in CI.

SEC-070 — Dependabot or Renovate configured

Level: 3 · Scope: repository · Check: deterministic
.github/dependabot.yml or renovate.json configured for both application dependencies and GitHub Actions.
Rationale: automated dependency updates close the gap between vulnerability disclosure and patching.
Evidence expected: config file present; PRs visible in history.

SEC-080 — Security headers set

Level: 4 · Scope: application · Check: deterministic
The application sets Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY (or frame-ancestors CSP), Referrer-Policy, Permissions-Policy, and a restrictive Content-Security-Policy.
Rationale: headers are free mitigation for entire bug classes; agents touching edge config must preserve them.
Evidence expected: inspection of proxy.ts / next.config.*; response headers on deployed endpoints.

SEC-090 — SBOM generated on release

Level: 5 · Scope: application · Check: deterministic
A Software Bill of Materials (CycloneDX or SPDX) is generated and attached to each release, and optionally signed (Sigstore).
Rationale: supply-chain incidents (e.g., xz) cost more when you don't know what's in your artifacts.
Evidence expected: SBOM artifact on a recent release; tooling in CI.

The 8 pillars — sibling pillars in v1.0.
Criteria catalog — all criteria, one page.
Maturity levels — how criteria combine into a level.

Criteria in this pillar

Level: 1 · Scope: repository · Check: deterministic

gitleaks (or trufflehog) scan of the full git history returns zero findings of API keys, tokens, private keys, or passwords.

Rationale: a leaked secret in history is a rotation emergency; agents must never author one.

Evidence expected: .gitleaks.toml present; CI runs gitleaks; zero findings.

Level: 1 · Scope: repository · Check: deterministic

.gitignore excludes .env, .env.local, .env.*.local, *.pem, *.key, service-account*.json, .aws/.

Rationale: default-deny on sensitive files is the cheapest single control.

Evidence expected: .gitignore contents.

Level: 2 · Scope: repository · Check: deterministic

CI runs pnpm audit --prod (or equivalent) and fails on HIGH or CRITICAL findings.

Rationale: known-vulnerable dependencies in production are a preventable class of incident; agents pulling new deps must know the bar.

Evidence expected: CI step; failure behavior confirmed.

Level: 2 · Scope: repository · Check: deterministic

CODEOWNERS exists at repo root and assigns at least one owner to the entire tree.

Rationale: ownership routes review to the right person; unreviewed changes are the most common regression source.

Evidence expected: CODEOWNERS file present; syntax valid.

Level: 3 · Scope: repository · Check: manual

main requires pull request review, passing CI, and no force-push. Documented in SECURITY.md or inferable from GitHub API.

Rationale: without branch protection, a compromised agent or account can land unreviewed code.

Evidence expected: GitHub branch protection rules; documentation acknowledging them.

Level: 3 · Scope: repository · Check: deterministic

Every commit to main contains a Signed-off-by trailer (DCO), or repository policy requires a CLA. Enforced via CI check.

Rationale: contribution provenance matters for legal and trust reasons; machine-checkable enforcement is cheap.

Evidence expected: commits on main inspected; DCO action in CI.

Level: 3 · Scope: repository · Check: deterministic

.github/dependabot.yml or renovate.json configured for both application dependencies and GitHub Actions.

Rationale: automated dependency updates close the gap between vulnerability disclosure and patching.

Evidence expected: config file present; PRs visible in history.

Level: 4 · Scope: application · Check: deterministic

The application sets Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY (or frame-ancestors CSP), Referrer-Policy, Permissions-Policy, and a restrictive Content-Security-Policy.

Rationale: headers are free mitigation for entire bug classes; agents touching edge config must preserve them.

Evidence expected: inspection of proxy.ts / next.config.*; response headers on deployed endpoints.

Level: 5 · Scope: application · Check: deterministic

A Software Bill of Materials (CycloneDX or SPDX) is generated and attached to each release, and optionally signed (Sigstore).

Rationale: supply-chain incidents (e.g., xz) cost more when you don't know what's in your artifacts.

Evidence expected: SBOM artifact on a recent release; tooling in CI.