Security Scanning

The checked-in CI configuration actively scans secrets. Dependency updates are managed by Dependabot. No image vulnerability scanner, dependency vulnerability scanner, or SAST job is defined in the repository workflows or justfile; this page does not claim coverage that CI does not provide.

See Three-Plane CI Setup for runner placement and the CircleCI nightly schedule.

Coverage matrix

Area	Configuration	Current behavior	Gate and evidence
Secret scanning	.github/workflows/security.yml and .gitleaks.toml	Gitleaks v8.30.1 scans the full Git history on pushes to main and pull requests targeting main. The repository allowlist is limited to verified placeholders in docs/examples and named test fixtures.	Blocking. A non-zero Gitleaks exit code fails the job; inspect the redacted output in the GitHub Actions log.
Dependency vulnerability review	.github/dependabot.yml	Dependabot checks the root Python dependencies, frontend npm dependencies, and GitHub Actions weekly. It groups minor and patch updates for the Python and frontend ecosystems.	Review the update pull requests. No pip-audit job or recipe is defined in the checked-in workflows or justfile.
Image scanning	No checked-in workflow or justfile recipe	Trivy image scanning and runtime smoke checks were removed. The heavy-plane Blacksmith runner and image-security job no longer exist.	No image vulnerability result is produced by the repository CI configuration. Treat image scanning as an explicit coverage gap.
SAST	No checked-in workflow or justfile recipe	Semgrep, CodeQL analysis, and another source-code analysis job are not configured here.	No SAST result is produced by the repository CI configuration. Treat SAST as an explicit coverage gap rather than assuming the secret scan replaces it.

The CircleCI commercial-license audit job checks license policy, not dependency vulnerabilities or source-code security. just check runs the product version check, Ruff format check, lint, and typecheck; it does not run a security scanner.

Gitleaks behavior

.github/workflows/security.yml checks out the repository with fetch-depth: 0 and runs the open-source Gitleaks CLI in Docker:

docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:v8.30.1 \
  git /repo --config /repo/.gitleaks.toml --redact --verbose --exit-code 1

.gitleaks.toml extends the default rules. Its allowlist is deliberately narrow: it covers known placeholder credentials in named documentation/example paths and specific placeholder strings. Do not turn it into a blanket exclusion for tests, source, or an entire directory. A finding fails the blocking job and remains visible in the GitHub Actions log.

Local checks

Run the repository's quality and lockfile checks separately from the security job:

just version-check
uv lock --check
uv sync --frozen --all-extras --dev
just check

To exercise the same Gitleaks command locally, run it from the repository root with the checked-in .gitleaks.toml shown above.

The checked-in justfile has no local pip-audit, Semgrep, or Trivy recipe. GitHub Actions remains the authoritative source for the configured Gitleaks scan; Dependabot update pull requests are the dependency-review evidence.