Anso 661b9c638b feat(security): enforce scan policies as a pre-deploy gate (#719) ...

Policies with block_on_deploy=1 now scan every stack image before
docker compose up runs and reject the deploy with HTTP 409 on violation.
The UI opens a dialog listing offending images; admins can override per
deploy with ?ignorePolicy=true, and every bypass is recorded in the
audit log with the originating route, actor, policy, and image list.

When Trivy is not installed on the target node the gate fails open with
a warning notification, so teams are never locked out by tooling state.
Post-deploy and scheduled scans still evaluate matching policies and
dispatch warnings on violations to surface drift on long-running stacks.

Public API additions: policy and suppression CRUD under /api/security,
plus the documented 409 block-response shape on all deploy paths.

2026-04-21 00:14:11 -04:00

..

overview.mdx

fix(container-exec): harden with security fixes, validation, and test coverage (#577)

2026-04-14 08:23:05 -04:00

security.mdx

feat(security): enforce scan policies as a pre-deploy gate (#719)

2026-04-21 00:14:11 -04:00