Phase 20: Security Deepening
Phase 20: Security Deepening
Goal: Multi-layer security hardening — dependency scanning, runtime threat detection, supply chain signing, and web app vulnerability scanning. Four subphases, each independently deployable.
Owner: Dev agent (per subphase)
Repo:
forgejo_admin/pal-e-platform (Falco, ZAP) + per-service repos (Renovate, Cosign)Depends on: Phase 10 (Vulnerability Scanning — Trivy in Harbor is layer 1), Phase 19 (Kyverno — admission control can enforce signed images)
Tier: 2 — Hardening. Netflix AppSec principle: driving adoption of security controls reduces more risk than vulnerability remediation. Bake security in, don't bolt it on.
DORA: CFR — every security tool reduces change failure rate. A CVE that ships is a failed change.
Scope
Parent phase with four subphases:
| Subphase | Tool | What | Risk Profile |
|---|---|---|---|
| 20a | Renovate | Dependency scanning — automated update PRs | Low — CI-only, no runtime impact |
| 20b | Falco | Runtime security — syscall monitoring daemonset | Medium — runs on every node |
| 20c | Cosign/Sigstore + Syft | Supply chain — image signing + SBOM | Medium — changes CI pipeline |
| 20d | OWASP ZAP | Web app scanning — HTTP endpoint probing | Low-Medium — active scanning |
Ordered by blast radius: 20a (lowest risk) → 20d (most invasive). Each subphase is one PR cycle.
Deliverables
- TBD — filled per subphase after completion
Related
plan-pal-e-platform— parent planphase-pal-e-platform-vuln-scanning— Phase 10, Trivy is layer 1phase-platform-19-policy-kyverno— Phase 19, Kyverno enforces signed imagesphase-pal-e-platform-dependency-scanning— Phase 11 (deferred, absorbed into 20a)