PRACTICE

Secure delivery

How changes reach production without becoming the incident: Semgrep on every push, a passive ZAP baseline against the deployed build, pinned dependencies asserted in CI, and guards on destructive operations.

Mocha.js
Jest
GoogleTest
Semgrep
OWASP ZAP

Files under SAST: 280
Latest DAST run: 0 fail · 57 pass

The position

Security here means the boring, verifiable kind: a build that cannot ship untested code, a destructive operation that refuses an unscoped call, a dependency that cannot silently jump a major version. These are architecture decisions, made where the change happens rather than audited afterwards. The numbers below are from real runs, not a description of a pipeline that might exist.

Testing frameworks

Three suites, one per layer, because they answer different questions. A unit test proves a function is correct; it cannot prove a dispatch workflow still behaves the way an operator expects after a configuration change.

GoogleTest
257 CASES
ROUTING ENGINE · C++
Unit, integration and endpoint suites over the solver and its constraint model, run under ctest in CI so a regression in routing behaviour stops the pipeline.
Mocha.js
CRITICAL DISPATCH FLOWS
AUTOMATION WORKFLOWS
Workflow validation rather than unit testing: a task moves through assignment, status transitions and callbacks the way an operator would drive it. This is what makes agent-driven and configuration-driven changes safe to ship — the assertion is against real business behaviour, not against a mock.
Jest
SERVICES AND UI
PLATFORM CODE
Unit and integration coverage on platform services and frontend code, where the fast feedback loop matters more than end-to-end fidelity.

Static analysis

Semgrep runs on every push, wired into CI with explicit rulesets. It reads the source without executing it, which makes it good at injection sinks, hardcoded secrets and unsafe calls — and blind to anything that only exists once the thing is running.

The single finding is a dynamic URL passed to urllib, which supports file:// schemes. Triaged low: the URL comes from an operator-set environment variable pointing at Qdrant, not from user input. Recorded rather than suppressed — a rule that is silently disabled stops being a control.

p/security-audit
p/secrets
p/c
p/typescript
p/react

Latest scan
TARGET	FILES	FINDINGS
Routing engine (C++)	179	0
Portfolio (TypeScript)	79	0
Memory layer (Python)	22	1

Dynamic analysis

OWASP ZAP attacks the deployed build over HTTP instead of reading its source. Passive baseline scan, no active attack. Latest run: 0 fail · 10 warn · 57 pass.

MEDIUM
Content Security Policy header not set
Nothing constrains which origins may load scripts or styles.
MEDIUM
Cross-domain misconfiguration
Access-Control-Allow-Origin is set to *, so any origin may read responses.
MEDIUM
Missing anti-clickjacking header
No frame-ancestors directive and no X-Frame-Options, so the page can be framed.
LOW
X-Content-Type-Options missing
Without nosniff, a browser may MIME-sniff a response into something executable.
LOW
Permissions-Policy, COOP and COEP not set
Browser feature and cross-origin isolation policies are left at defaults.

HSTS is present with a two-year max-age, and the scan produced no failures — every alert is a hardening gap rather than an exploitable defect.

The scan also found a robots.txt advertising a sitemap that returns 404. Static analysis could never have seen that: it is a property of what is deployed, not of what is written.

Path to production

DELIVERY PATH

Git, with work branched per feature rather than accumulating on a shared trunk.

TESTS GATE THE PIPELINE: The routing engine's 257 GoogleTest cases run under ctest in CI, and a failure stops the run before anything is published. The image itself is built multi-stage, so the runtime carries the binary and not the toolchain.
GUARDS ON DESTRUCTIVE OPERATIONS: A delete tool whose documented scope guard was dead code got the guard restored, with a test proving it refuses unscoped calls and still permits scoped ones.
REFUSE UNSAFE DEFAULTS: The memory layer's transport has no inbound authentication, so its installer refuses to bind 0.0.0.0 and the destructive tools are disabled on the client that supports it.
PINNED AND ASSERTED: Dependencies that shipped breaking majors are capped, and CI asserts the ceilings are still present rather than trusting a lockfile.
ACCESS CONTROL: ACL/RBAC designed for hierarchical enterprise teams, so permissions follow the org structure instead of being flattened.
FAIL LOUDLY: Fatal signals are caught and logged rather than letting the engine die silently, and monitoring alerts on SLA thresholds before operations notice.