table inet filter {
  chain input {
    type filter hook input priority 0;
    policy drop;

    ct state established,related accept

Protocol 2
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AllowUsers deploy ops

apiVersion: v1
kind: ServiceAccount
metadata:
  name: metrics-reader
  namespace: production
---

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-ingress
  namespace: production
spec:

- name: Build image
  run: docker build -t app:${{ github.sha }} .

- name: Scan image
  uses: aquasecurity/trivy-action@0.24.0
  with:

FROM ruby:3.3.1-slim AS base

RUN apt-get update \
  && apt-get install -y --no-install-recommends build-essential libpq-dev \
  && rm -rf /var/lib/apt/lists/*

#!/usr/bin/env bash
set -euo pipefail

bundle exec bundler-audit check --update
npm audit --audit-level=high
pip-audit --strict

name: semgrep

on: [pull_request]

jobs:
  scan:

repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.4
    hooks:
      - id: gitleaks
  - repo: https://github.com/Yelp/detect-secrets

#!/usr/bin/env bash
set -euo pipefail

export VAULT_ADDR="https://vault.internal:8200"
export VAULT_TOKEN="${VAULT_TOKEN:?missing VAULT_TOKEN}"

import psycopg

with psycopg.connect(conninfo) as connection:
    with connection.cursor() as cursor:
        cursor.execute(
            'SELECT id, email FROM users WHERE email = %s',

Rails.application.config.session_store(
  :cookie_store,
  key: '_codesnips_session',
  secure: Rails.env.production?,
  httponly: true,
  same_site: :lax,