Roadmap relationship
Outcome
Unify configuration security, host posture, identity findings, secret scanning, container/software supply-chain checks, and deploy policy into an actionable dashboard with explainable severity and controlled exceptions.
Current gap
ts-cloud has pre-deploy secret scanning and some host security views, but findings are not persisted, correlated, assigned, waived with expiry, or enforced through a central policy. Container image scanning, SBOMs, signature/provenance checks, and credential/IAM validation are incomplete.
User experience
- Show posture by project/environment/service with severity, affected resource, evidence, first/last seen, remediation, owner, and status.
- Policy-gated deploys explain exactly which checks failed and offer safe remediation links; authorized waivers require a reason and expiry.
- Distinguish failed, skipped, unavailable, unsupported, and stale checks.
- Provide a production-change review screen summarizing security-impacting diffs.
Scope
- Persist normalized findings from secret scans, host checks, dependency/container scans, TLS/firewall checks, and provider security services where available.
- Generate SBOMs for built artifacts/images, scan known vulnerabilities, and support optional image signature/provenance verification.
- Define policy rules by environment and severity for block, warn, or record-only behavior.
- Add exception workflow, assignment, comments/links, expiry, recurrence, and export.
- Integrate existing audit work in #126 rather than creating a separate action log.
Technical direction
- Use pluggable scanners with timeouts, version metadata, deterministic fingerprints, and sanitized evidence.
- Run untrusted artifact inspection with bounded resources and without exposing deployment credentials.
- Record the exact policy/scanner versions used for each deploy decision.
- Wire the currently permissive credential/IAM validation path to real capability checks where provider APIs support it.
Safety and operability
- Never upload proprietary source or SBOM contents to third parties without explicit configuration.
- Redact secrets from findings and scan logs; treat generated reports as sensitive.
- Waivers cannot silently outlive their expiry and all policy changes/waivers are audited.
- Scanner outages follow explicit fail-open/fail-closed policy per environment.
Acceptance criteria
- A production deploy can be blocked by a reproducible critical finding and proceed after remediation or an authorized time-limited waiver.
- An image build produces an SBOM and vulnerability summary linked to its release.
- Repeated scans update the same finding lifecycle instead of creating unbounded duplicates.
- The posture page works when individual scanners/providers are unavailable.
Verification
- Finding fingerprint/lifecycle, policy evaluation, waiver expiry, redaction, timeout, and fail-mode tests.
- Fixture-based secret, SBOM, vulnerable image, TLS, and host-posture integration tests.
- End-to-end blocked-deploy and remediated-redeploy scenarios.
Non-goals
- Building a proprietary vulnerability database.
- Replacing specialized cloud security consoles.
- Treating a clean scan as a guarantee that software is secure.