feat/sec-base

CloudTrail adoption: live trail not CDK-managed, no import mechanism specified

.branch/scope.md

live batu-org-trail exists but was never deployed by CDK. cdk import or manual deletion required. 'cdk synth passes' is insufficient as success criterion.

AuditTrailStack single-region vs live org-wide multi-region trail — reconcile target ambiguous

.branch/scope.md

Existing stack sets isMultiRegionTrail: false. Scope must specify whether to match live (multi-region) or accept mismatch.

GuardDuty org auto-enable requires out-of-band delegated admin setup CDK cannot perform

.branch/scope.md

CDK alone cannot designate delegated admin via Organizations. Risk of false compliance signal — live GuardDuty stays management-account-only.

Management-account CDK deploy has no approval gate in infra-cdk.yml

.branch/scope.md

infra-cdk.yml accepts 'management' target with --require-approval never. No branch restriction or Environment approval gate.

GitHub org settings (SG-3) are one-time imperative step — not durable or re-verifiable

.branch/scope.md

Scope log entry does not survive repo clone. Needs a CI GET check verifying current org settings.

AuditTrail S3: 365-day hard delete vs potential 7-year SOC 2 retention requirement

.branch/scope.md

Scope does not mention reviewing retention policy during reconciliation.

pnpm audit advisory-only: HIGH/CRITICAL CVEs can ship to production unblocked

.branch/scope.md

SOC 2 CC6.1 and ISO 27001 A.12.6 require timely remediation. Block on CRITICAL; advisory HIGH with 30-day SLA.

Management-account CDK stacks lack deploy guard — accidental org-wide change risk

.branch/scope.md

Add CDK Environment pin AND synth-time guard throwing outside management-account context.

CodeQL JS/TS only — shell scripts not scanned; ShellCheck gap

.branch/scope.md

Add ShellCheck CI step for all .sh files (lib/sandbox.sh, scripts/loop/).

GuardDuty org-wide enable: no suppression or alerting plan documented

.branch/scope.md

Without suppression filters and SNS→Slack routing, team faces alert fatigue. SOC 2 requires demonstrated response.

Dependabot grouped PRs may silently break pnpm workspace peer resolution

.branch/scope.md

Ensure PR checks run pnpm install --frozen-lockfile and full workspace build on Dependabot PRs.

Push protection friction for test fixtures with secret-shaped strings

.branch/scope.md

Audit test fixtures before enabling push protection.

Policy skeletons in repo may expose control gaps if repo visibility changes

.branch/scope.md

Confirm repo visibility. If public-risk, move policy docs to private Notion.

AuditTrailStack likely missing mandatory batu:* resource-level tags

infra/cdk/src/stacks/audit/audit-trail.stack.ts

Mandatory batu:* tags enforced by aspects. dataClass='confidential' for audit logs required.

.claude/rules/compliance.md always-loads — SSOT content will pad every conversation

.branch/scope.md

Consider narrow path scope or keeping compliance.md minimal with deep content in docs/.

codeql.yml push trigger needs branches-ignore to avoid doubling with loop-review.yml

.branch/scope.md

Restrict push trigger to branches: [main] or add branches-ignore matching loop-review.yml pattern.

pnpm audit job must be wired into pr-checks.yml summary gate

.branch/scope.md

Add security-audit to summary.needs with skippable logic.

No CDK assertions tests planned for security stacks

.branch/scope.md

CDK assertions tests are pure/in-memory and would provide auditable compliance evidence for each control.

GuardDutyBaselineStack org-enrollment stub has no testable extension path

.branch/scope.md

'cdk synth passes' cannot distinguish a stub from a fully configured stack.

GitHub org settings success criterion is one-time manual observation

.branch/scope.md

Not durable, not re-runnable. Needs a CI GET check verifying current org settings.

cdk synth invocation context for management stacks must be specified explicitly in CI

.branch/scope.md

Management stacks only instantiate when !branch. Exact CDK command must be documented and enforced in CI.

pnpm audit advisory mode has no documented escalation path

.branch/scope.md

No severity threshold, owner, or SLA defined.

SBOM generation absent — required for SOC 2 Type II supply chain evidence

.branch/scope.md

SOC 2 CC6.8 and ISO 27001 A.14.2.7 require SBOM. Add anchore/sbom-action weekly job emitting CycloneDX/SPDX to S3.

CI-layer secret scanning absent — truffleHog or gitleaks gap

.branch/scope.md

Push protection alone doesn't cover historical commits or custom Supabase/Tinybird token shapes.

Semgrep should augment CodeQL for Next.js/ts-rest specific SAST

.branch/scope.md

Semgrep p/nextjs, p/typescript, p/security-audit rulesets catch framework-specific issues CodeQL misses.

AuditTrailStack reconcile strategy must be specified: cdk import vs config-match

.branch/scope.md

cdk import is safer (no logging gap) but requires exact config match.

18 policy skeletons need ISO 27001 frontmatter for audit readiness

.branch/scope.md

Each skeleton needs YAML frontmatter: owner, version, effective_date, review_date, annex_a_controls.

CodeQL not wired as required branch protection check — no enforcement

.branch/scope.md

Add CodeQL to branch ruleset required status checks via gh api.

GuardDuty auto-enable: new accounts vs existing member accounts scope unclear

.branch/scope.md

Existing dev/stg/prod accounts may remain unprotected if only new-account auto-enable is configured.

compliance.md needs Controls → Implementation table to prevent drift

.branch/scope.md

Cross-reference CI workflows and CDK stacks as live implementation of each control.