Security
GarraIA is designed with security as a core principle.
Security Policy
Supported Versions
Auth configuration — GarraIA Gateway
Reference for the [auth] config block and the environment variables
Visão geral de segurança
Documentação técnica de segurança do GarraIA.
GarraIA — STRIDE Threat Model
- Status: Draft v1 (2026-04-21)
Decisões de Hardening e Postura de Segurança
Este documento consolida as decisões arquiteturais de segurança e mitigação de riscos no michelbr84/GarraRUST.
Secret Scanning Runbook
Status: established 2026-04-30 as part of the Green Security Baseline
CodeQL Setup Runbook
Status: established 2026-04-30 (PR C of the Green Security Baseline
CodeQL Suppressions Ledger
Convenção operacional: Rust CodeQL ainda não suporta comentários inline
dependabot-status
Last updated run 145 2026-06-15 — health routine, priority (i): all surfaces clean, sqlx compat noted. run 144 (GAR-892) priority (i); run 136 (GAR-886) priority (i); run 135 (GAR-883) merged PR #772; run 134 (GAR-882) merged PR #769; run 133 (GAR-880) merged PR #764; run 132 (GAR-879) merged PR #763; run 131 (GAR-878) merged PR #760; run 130 (GAR-877) merged PR #758; run 129 (GAR-875) Linear-only status note (no PR); run 128 (GAR-873) merged PR #754; run 127 (GAR-872) merged PR #752; run 126 (GAR-870) merged PR #749; run 125 (GAR-868) merged PR #746 (rebased — plan renumbered 0327→0329); run 124 (GAR-867) merged PR #744; run 123 (GAR-865) merged PR #739; run 122 (GAR-863) merged PR #736; run 121 (GAR-861) merged PR #733; run 120 (GAR-859) merged PR #732; run 119 (GAR-857) merged PR #731; run 118 (GAR-855) merged PR #727; run 117 (GAR-854) merged PR #726; run 116 (GAR-852) merged PR #724; run 115 (GAR-849) merged PR #722; run 114 (GAR-848) merged PR #721; run 113 (GAR-846) clean; run 112 (GAR-843) clean; run 111 (GAR-842) clean; run 110 (GAR-841) merged PR #713; run 109 (GAR-839) merged PR #711; run 108 (GAR-838) merged PR #710; run 107 (GAR-836) clean; run 106 (GAR-833) clean; run 105 (GAR-832) clean; run 104 (GAR-831) merged PR #698; run 103 (GAR-830) merged PR #697; run 102 (GAR-829) clean; run 101 (GAR-828) clean; run 100 (GAR-826) clean; run 99 (GAR-824) merged PR #687; run 97 (GAR-822) CI swagger-ui fix; run 96 (GAR-820) clean; run 93 (GAR-817) priority (h) fix RUSTSEC-2026-0173).
Branch protection ruleset — main
Fonte de verdade
Conformidade (visão geral)
Documentos de compliance LGPD (Lei Geral de Proteção de Dados, Brasil) + GDPR (General Data Protection Regulation, UE).
GarraIA — Data Protection Impact Assessment (DPIA)
- Status: Draft v1.1 (2026-10-09) — pending external legal review antes do GA (a revisão legal externa segue pendente; ver Aviso legal — este DPIA continua sendo o relatório técnico, não registro de revisão jurídica concluída)
GarraIA — LIA (Legitimate Interests Assessment) — ip_inet + user_agent
- Status: RASCUNHO técnico (2026-10-09) — sujeito a revisão jurídica
GarraIA — Incident Response Runbook (ANPD / GDPR 72h)
- Status: Draft v2 (2026-10-09) — pending tabletop exercise antes do GA (material de exercício na §11; execução com data real pendente)