1d4eebca54
- TypeScript + Fastify skeleton under project/ (src/modules, shared, infrastructure, app) - scripts/check-module-boundaries.mjs enforcing module public-API rules (tested with fixtures) - GET /health endpoint, error envelope without stack leakage - specs/F-001-scaffold (SPEC/DESIGN/TASKS/TESTS), spec/tech.md dependency justification - 30-ticket MercadoDeVida roadmap in backlog/features.json, spec/roadmap.md - All gates approved: reviewer, security, qa; verify.sh green
13 lines
501 B
Markdown
13 lines
501 B
Markdown
# Security Policy
|
|
|
|
## Gate de seguridad (obligatorio)
|
|
Cada feature debe tener `work/artifacts/<feature_id>/security.json` con:
|
|
- `verdict`: APPROVED | CHANGES_REQUESTED
|
|
- `checks`: secretos, dependencias, SAST básico, validación de inputs
|
|
- `findings`: lista de hallazgos con severidad
|
|
|
|
## Reglas
|
|
- Si hay hallazgos críticos/altos sin mitigación: `CHANGES_REQUESTED`.
|
|
- No se permite exponer credenciales ni secretos en repo/chat.
|
|
- Dependencias nuevas requieren justificación en `spec/tech.md`.
|