# Security

See [SECURITY.md](https://github.com/Orxaq/orxaq/blob/main/SECURITY.md) for the full security policy.

## Security Architecture

### Zero-Dependency Kernel

Ring 1 (Kernel) has zero external dependencies, using only Python stdlib. This eliminates supply chain attack surface for the core type system, audit log, and cryptographic primitives.

### Audit Trail

Every operation is recorded in a hash-chained audit log. Each entry includes a SHA-256 hash of the previous entry, providing tamper detection.

### CI Security Pipeline

- **Bandit**: Static application security testing (SAST) for Python
- **Safety**: Dependency vulnerability scanning
- **Secret detection**: Grep-based scanning for hardcoded secrets
- **Pre-commit hooks**: 14 hooks including ruff linting, secret scanning, and test execution

### Container Security

- Non-root container user (`orxaq`, UID 1000)
- Minimal base image (`python:3.12-slim`)
- Health check endpoint for orchestrator monitoring
