Authentication & sessions
JWT (HttpOnly cookie path), rate limiting, logout revocation. ADR-008, ADR-018.
Security & DevSecOps
Security scanning stays with the source (ADR-024 critique of a standalone security repo). The security/ module owns protection-as-code and the inventory of controls.
Business audit
AuditoriaAspect records create/update/delete and logins from SecurityContext — not client headers.
SAST / SCA / DAST
CodeQL, dependency review, Trivy image/fs scans, ZAP DAST workflows run where the source lives.
Repository protection
security/ module holds rulesets-as-code and the control map; apply with admin PAT (#1040).
Sec by Design
Threat model, security case catalog, policy-as-code, and local gates before a pull request. Program: CYBERSECURITY-PROGRAM.md (#307, #1500).