What does the CI/CD security pipeline look like?
Every pull request and build at amaise goes through automated security gates:
Secret scanning — Detection of accidentally committed secrets in the code
Build and lint — Static application security testing (SAST) and code formatting for all components
Dependency check — Software composition analysis (SCA) with build failure for CVSS ≥ 7
Unit tests — per component
Integration tests — parallelized API integration tests
E2E tests — browser-based end-to-end tests
Infrastructure validation — IaC security scanning and best practice checks
All gates must be passed before a PR can be merged. A senior engineer must approve each PR. Direct production pushes require approval from the technical lead.
Deployments to production automatically create a database snapshot and run smoke tests and E2E tests.