ForgeGate takes security seriously across dependencies, application source code, secrets management, and container images. This document outlines the automated security controls in CI and provides instructions for developers to run security audits locally.

Developers should perform local security verification before submitting pull requests.

Run the automated dependency audit script:

pnpm run audit

Or specify custom severity levels:

pnpm audit --audit-level high

Transitive patches: If a transitive dependency has a known vulnerability, override it cleanly in pnpm-workspace.yaml under overrides: (e.g., tar: "^7.5.21"). Do not perform major version upgrades unless verified.

To scan your local git repository and staged commits for accidentally hardcoded secrets (API keys, JWTs, private keys, credentials):

# Detect hardcoded secrets locally with Gitleaks
gitleaks detect --verbose

To audit built Docker images for OS and library vulnerabilities:

# Build the image locally
docker build -t forgegate-app:local .

# Audit with Trivy CLI
trivy image --severity HIGH,CRITICAL forgegate-app:local

ForgeGate CI executes the following security workflows on every push and pull_request to main, master, or dev:

1. Dependency Audit Job: Executes pnpm run audit (--audit-level high) in .github/workflows/security.yml.
2. Secret & Credential Scanning Job: Runs gitleaks/gitleaks-action across full Git history. Secret values are masked and never exposed in CI logs.
3. Static Application Security Testing (SAST): Executes GitHub CodeQL (.github/workflows/codeql.yml) for javascript-typescript.
4. Container Image Scanning: Runs aquasecurity/trivy-action on built Docker images (forgegate-app and forgegate-api-gateway).
5. Dependabot Updates: Weekly checks configured via .github/dependabot.yml. Dependabot is explicitly restricted from making semver major version upgrades to prevent breaking changes.

• Environment Variables: Use .env.example as a reference template. Never commit real secrets, private keys, DB credentials, or API keys to repository files.
• CI Secrets: Store deployment and integration credentials strictly in GitHub Repository Secrets.
• Log Masking: Ensure structured loggers mask or truncate tokens, authorization headers, and API keys (sanitizePayloadString).

If you discover a potential security vulnerability in ForgeGate, please report the security concern responsibly via email or private security disclosure.