Segurança de Software de Verdade: threat model ao SBOM

# Pre-commit hook: trufflehog ou gitleaks bloqueia secret antes do commit
# .pre-commit-config.yaml
- repo: https://github.com/gitleaks/gitleaks
  rev: v8.18.0
  hooks:
    - id: gitleaks

# CI
- name: Scan for secrets
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# Em runtime (Node + AWS)
import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';
const client = new SecretsManagerClient({ region: 'us-east-1' });
const secret = await client.send(new GetSecretValueCommand({ SecretId: 'prod/db/password' }));
// nunca console.log(secret), nunca persiste em disco

# Gerar SBOM
syft packages dir:. -o cyclonedx-json > sbom.json

# Scan de vuln contra SBOM
grype sbom:./sbom.json --fail-on high

# Assinar imagem Docker
cosign sign --key cosign.key ghcr.io/empresa/app:${SHA}

# Verificar na hora do deploy (policy de admission)
cosign verify --key cosign.pub ghcr.io/empresa/app:${SHA}

# Headers mínimos em toda resposta HTTP (API ou web)
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-...'; object-src 'none'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-site