moai-ref-secops

Run secret scanning as both a pre-commit hook and a CI step over the full git history, scope secrets per job, use short-lived federated credentials, and enable log redaction. A detected secret must be rotated, not just deleted, since it remains in history.

Apply the hardened-pod baseline: run as non-root, use a read-only root filesystem, drop all Linux capabilities, enforce a seccomp profile, disable privileged mode and privilege escalation, and never mount host paths or the runtime socket. Enforce this at admission with PodSecurity restricted profile.

This Skill covers the operational runtime layer: detecting BOLA in production traffic, enforcing rate limits at the gateway, and tuning a WAF. moai-ref-owasp-checklist covers dev-time secure coding like parameterized queries, input validation, and security headers. The two are consulted together.

No. It is strictly defensive: every section frames a misconfiguration, how to detect it, and how to prevent it. It explicitly excludes exploit execution, container-escape attack steps, privilege-escalation procedures, and attack tooling.

Enforce a server-side ownership check on every object access; never trust a client-supplied object ID as proof of authorization. Operationally, monitor production traffic for one identity accessing another's object IDs, since frontend checks are not a control.

IaC scanning must run as a CI gate before the apply stage, failing closed on high-severity findings like public buckets or wildcard IAM policies. A scan that runs after apply is detection, not prevention, and drift detection should reconcile live infrastructure against the versioned definition.