Every merge to
master runs through multiple automated security gates. Every dependency is scanned on every build. Every surfaced vulnerability has a defined SLA for remediation.Static application security testing (SAST)
Dependency scanning
Secret scanning
- gitleaks runs on every commit.
- GitHub secret scanning enabled organization-wide (catches known secret formats pushed to any branch).
- Any secret found in git history triggers immediate rotation and incident logging.
Infrastructure scanning
- Trivy (config scan mode) runs against every Terraform change.
- GCP Security Command Center aggregates findings from GCP-native scanners (Container Analysis, Web Security Scanner — planned).
Vulnerability disclosure and remediation SLAs
Coordinated disclosure
Security researchers: see the vulnerability submission process on Incident response or email security@denialbase.com.Current gaps — honest status
No DAST (dynamic testing) in CI
No DAST (dynamic testing) in CI
We run SAST on every merge but no automated dynamic scanner exercises the running app. The planned third-party pentest (Q3 2026) will include dynamic testing.
No bug bounty program yet
No bug bounty program yet
We credit researchers and coordinate disclosure, but don’t currently pay bounties. Planned after our first pentest cycle completes.
No runtime application self-protection (RASP)
No runtime application self-protection (RASP)
Relying on Cloud Armor WAF at the edge + application rate limiting. A RASP layer would provide additional depth but isn’t on the near-term roadmap.