Add security-review gate (review.sh + scanners + CI backstop) #5

Merged

amoussa1229 merged 2 commits from security-review-gate into main

2026-06-15 19:59:00 +00:00

Author	SHA1	Message	Date
Adam Moussa	f90f759e12	Tune checkov severity, wire npm audit, add CI backstop + R720 runbook checkov: high-signal exposure/access checks -> high, best-practice noise -> low (was 51 undifferentiated mediums). npm audit wired for Node dep CVEs. Report collapses the low/info tail to a count. Adds ci/security-review.yml (PR backstop) and DEPLOY-R720.md (Phase 3 host runbook).	2026-06-15 15:57:34 -04:00
Adam Moussa	7e5ce1f5b2	Add security-review gate (review.sh + scanners + pre-commit hook) Trigger-agnostic pure-code gate that merges deterministic-scanner findings (semgrep/gitleaks/checkov/cfn-lint/pip-audit) with agent findings from /sh-security-review, dedups, applies justification-required suppressions, and makes the block decision (exit 1 on confirmed critical/high). Phase 2 of the Sea Haven security-review agent; Path B (CI/headless) wiring lands in Phase 3.	2026-06-15 15:52:15 -04:00

Author

SHA1

Message

Date

Adam Moussa

f90f759e12

Tune checkov severity, wire npm audit, add CI backstop + R720 runbook

checkov: high-signal exposure/access checks -> high, best-practice noise -> low
(was 51 undifferentiated mediums). npm audit wired for Node dep CVEs. Report
collapses the low/info tail to a count. Adds ci/security-review.yml (PR backstop)
and DEPLOY-R720.md (Phase 3 host runbook).

2026-06-15 15:57:34 -04:00

Adam Moussa

7e5ce1f5b2

Add security-review gate (review.sh + scanners + pre-commit hook)

Trigger-agnostic pure-code gate that merges deterministic-scanner findings
(semgrep/gitleaks/checkov/cfn-lint/pip-audit) with agent findings from
/sh-security-review, dedups, applies justification-required suppressions, and
makes the block decision (exit 1 on confirmed critical/high). Phase 2 of the
Sea Haven security-review agent; Path B (CI/headless) wiring lands in Phase 3.

2026-06-15 15:52:15 -04:00