Continuous verification, performance regression monitoring, and automated threat gates for maily.
| Security Domain | Tool / Engine | Enforcement Policy | Gate Status |
|---|---|---|---|
| Secret Leak Prevention | Gitleaks 8.x + GitHub Secret Scanning | Full commit history & PR diff scanning with push protection | 🛡️ Active |
| Container Vulnerabilities | Aquasecurity Trivy (SARIF) | Blocks CRITICAL & HIGH CVEs in Docker runtime base image | 🛡️ Active |
| Dependency Vulnerabilities | Pip-Audit (PyPI Advisories) | Scans production dependencies against OSV and PyPA databases | 🛡️ Active |
| Static Application Security (SAST) | GitHub CodeQL Engine | Deep semantic AST queries analyzing tainted data flows | 🛡️ Active |
| Actions Workflow Security | Zizmor Static Analyzer | Verifies least privilege tokens, pinned SHAs, and injection prevention | 🛡️ Active |
| Supply Chain Integrity | Cosign + GitHub OIDC Trusted Publishing | Keyless signature attestation & direct tokenless PyPI uploads | 🛡️ Active |
| Category | Tool / Specification | Standard | Gate Status |
|---|---|---|---|
| Strict Typing | Mypy 2.4.1 (Strict Mode) | 100% typed public APIs in server, client, and scripts | ✓ Enforced |
| Linting & Formatting | Ruff 0.14.x | Fast AST checks, unused imports, docstring style | ✓ Enforced |
| Mutation Testing | Mutmut Test Engine | Guarantees tests kill mutants; catches missing assertions | ✓ Ratchet 90% |
| Performance Regressions | pytest-benchmark Delta Engine | Blocks PRs introducing > 25% latency regression | ✓ Monitored |
| Semantic Release Delivery | Release Please + Conventional Commits | Enforces `feat:`, `fix:`, `docs:`, automated semver changelogs | ✓ Automated |
| Documentation Links | Lychee Link Checker | Validates HTTP URLs in markdown & docstrings to avoid link rot | ✓ Enforced |