[DevOps/Security] Automated Static Security Analysis & Vulnerability Scanning Pipeline

[blurbeast]

Overview & Background

Security is critical for financial payment infrastructure. Implementing an automated security scanning pipeline in CI detects supply chain vulnerabilities, secret leaks, and static code vulnerabilities before pull requests are merged.

---

Technical Specification & Architecture

1. Security Workflow (.github/workflows/security.yml):
   • Rust Audit: cargo audit for contract dependencies.
   • Node.js Audit: npm audit --audit-level=high across workspaces.
   • Secret Scanning: trufflehog or gitleaks scanning repository history.
   • Static Code Analysis (SAST): Semgrep scanning for common Node/React/Rust anti-patterns.
2. Automated Weekly Security Scan:
   • Schedule weekly cron job to detect newly published CVEs in existing dependencies.

---

Target Files

• .github/workflows/security.yml
• SECURITY.md

---

Acceptance Criteria

• Security workflow runs on all PRs and weekly schedule.
• Blocks PRs with known high/critical severity dependency CVEs or exposed secrets.
• Generates SARIF security reports in GitHub Security tab.

[egwujiohaifesinachiperpetual-max]

Please assign
ETA is 4 hours