Security posture

Every collector is scanned on every change, and its security posture is published with it: each collector’s page in the catalogue ends with its summary. These are scanners, not agents, and nothing about them is a claim you have to take on trust: each line below says what runs and what it gates.

When the scans run

• On every merge request.
• On every change to the default branch.
• On every release tag.
• Weekly, on Sunday at 03:00 UTC, so a newly published vulnerability in a dependency that has not changed is still found.

What is scanned

Check	Tool	Gate
Secrets	gitleaks, over the repository’s full history	Any finding fails
Static analysis	Semgrep and Bandit, per collector	A high or critical finding blocks a release
Dependencies	pip-audit and OSV-Scanner, on the collector’s resolved dependencies	A high or critical finding blocks a release
Bill of materials	CycloneDX	Produced for every collector
Licences	A licence check against an allow-list: MIT, BSD, Apache-2.0, ISC, PSF and MPL-2.0	Anything else fails
Network	Every host the collector’s code names must be in its manifest’s hosts list	An undeclared host fails
Read only	A behavioural test, in the collector’s own suite, drives it over a recording transport and checks that it never writes (no POST, PUT, PATCH or DELETE), except the read operations its manifest documents, such as a token request or a search POST	Missing or failing fails

The same secrets scan and pre-commit hooks run in every Atlantic repository: see Supply chain.

The release gate

A collector with any high or critical finding is marked release_blocked, and the release job refuses to tag a release of the repository while any collector is blocked. So no catalogue release, and no page on this site, carries a collector with an open high or critical finding.

The security summary

The scans are merged into the collector’s security.json. The one committed with the collector, and published in the catalogue, is from the last pipeline on the default branch; a merge request’s own result stays with that merge request.

On the page	From security.json
Last scanned	scanned_on (the pipeline is in a members-only project, so it is not linked)
Findings by severity	findings: critical, high, medium, low and info, across every scanner
Release blocked	release_blocked
Network allow-list check	hosts_check, against the manifest’s hosts
Read-only behavioural test	read_only_test
SBOM	sbom: the CycloneDX file
Dependency licences	licences: each package and its licence
Scanners	tools: each scanner and its version

A collector that has not yet been through a scan on the default branch shows Scan pending on each line it lacks and does not show a pass.