ops: enable Dependabot, pin Actions to SHA, add npm audit gate

.github/dependabot.yml

@@ -0,0 +1,45 @@
+version: 2
+
+updates:
+  # npm — group minor/patch into one weekly PR; keep major separate
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    groups:
+      # All minor + patch updates arrive as a single PR per week
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+    ignore:
+      # Major bumps require deliberate review — they arrive individually
+      []
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "chore(deps)"
+
+  # GitHub Actions — pin to SHA; group minor/patch the same way
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    groups:
+      actions-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore(actions)"

.github/workflows/ci.yml

@@ -11,9 +11,10 @@ jobs:
     name: Lint, build, test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # Pin to commit SHA — mutable tags can be repointed by the action owner
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           cache: npm
@@ -29,3 +30,7 @@ jobs:
 
       - name: Test
         run: npm test --if-present
+
+      # Fail the build on high or critical vulnerabilities
+      - name: Audit dependencies
+        run: npm audit --audit-level=high

SECURITY.md

@@ -1,62 +1,80 @@
 # Security Policy
 
-ModelTrace handles attestation, metering, and settlement of AI inference. A
-vulnerability here can mean forged audit evidence or misdirected funds, so we
-treat reports seriously and will credit reporters who follow this process.
+## Supported Versions
 
-## Reporting a vulnerability
+| Version | Supported |
+| ------- | --------- |
+| `main`  | ✅ Yes     |
 
-**Do not open a public issue for an undisclosed vulnerability.**
+Only the current `main` branch receives security fixes. No LTS or versioned releases are supported at this stage.
 
-Use GitHub's private reporting: **Security → Advisories → Report a vulnerability**
-on this repository. If that is unavailable, contact the maintainers listed on the
-[FinesseStudioLab](https://github.com/FinesseStudioLab) organization profile.
+---
 
-Please include:
+## Reporting a Vulnerability
 
-- Affected component and version or commit SHA
-- Reproduction steps or a proof of concept
-- Impact assessment — what an attacker gains
-- Any suggested remediation
+**Do not open a public GitHub issue for security vulnerabilities.**
 
-## Response targets
+Please report security issues by emailing **devsolex6@gmail.com** with the subject line:
 
-| Stage | Target |
-| --- | --- |
-| Acknowledgement | 48 hours |
-| Initial assessment | 5 business days |
-| Fix or mitigation plan | 30 days for high/critical |
+```
+[SECURITY] modeltrace-backend — <brief description>
+```
 
-## Scope
+Include:
+- A description of the vulnerability and its potential impact.
+- Steps to reproduce or a proof-of-concept (if safe to share).
+- Affected component (e.g., route, dependency, CI pipeline).
+- Your GitHub handle or preferred contact for follow-up.
+
+---
+
+## Response Timeline
+
+| Stage | Target SLA |
+| ----- | ---------- |
+| Acknowledgement | Within **48 hours** of receiving the report |
+| Initial triage (severity classification) | Within **5 business days** |
+| Fix for **Critical** severity | Within **7 days** of confirmed triage |
+| Fix for **High** severity | Within **14 days** of confirmed triage |
+| Fix for **Medium / Low** severity | Next regular release cycle (≤ 30 days) |
+| Public disclosure | After patch is merged and released; coordinated with the reporter |
+
+If a fix cannot be delivered within the above windows, we will notify the reporter with an updated timeline and interim mitigations.
+
+---
 
-In scope: contract logic, authorization boundaries, arithmetic and rounding in
-metering or settlement, API authentication and authorization, secret handling.
+## Dependency Scanning
 
-Out of scope: findings that require a compromised maintainer machine, denial of
-service via unbounded self-funded transaction volume on public testnets, and
-issues in third-party dependencies with no exploitable path through this code
-(report those upstream, but tell us so we can pin or patch).
+This project uses:
+
+- **Dependabot** — weekly PRs for npm and GitHub Actions updates (minor/patch grouped; majors arrive separately).
+- **`npm audit`** — runs in CI on every push and pull request; the build fails on `high` or `critical` advisories.
+- **GitHub Secret Scanning** — push protection is enabled; commits containing detected secrets are blocked.
+
+### Pinned GitHub Actions
+
+All GitHub Actions in `.github/workflows/` are pinned to immutable commit SHAs rather than floating version tags. This prevents supply-chain attacks where a tag is repointed to malicious code. Dependabot keeps the SHA pins up to date automatically.
+
+---
+
+## Scope
 
-## Disclosure
+The following are **in scope** for security reports:
 
-We aim to coordinate disclosure once a fix ships. Contracts already deployed to
-mainnet may warrant a longer embargo; we will tell you if so and why.
+- Authentication bypass or privilege escalation in API routes.
+- Secrets or signing keys exposed via logs, responses, or environment variables.
+- Injection vulnerabilities (SQL, command, SSRF, etc.) in any route or integration layer.
+- Soroban / Stellar transaction manipulation (incorrect fee, replay, signature bypass).
+- Supply-chain issues in npm or GitHub Actions dependencies.
 
-## Signing key custody
+The following are **out of scope**:
 
-This service **never signs transactions that move value.** Settlement, refunds,
-and dispute payouts are returned to the caller as unsigned XDR envelopes, so a
-full compromise of `modeltrace-api` cannot move funds.
+- Issues in dependencies that already have a published advisory and an open Dependabot PR.
+- Theoretical vulnerabilities with no practical exploit path.
+- Social engineering or phishing attacks.
 
-The only key that may exist here is a low-privilege attestation key, held in a
-KMS and scoped on-chain to attestation entry points. Compromise costs
-audit-record integrity for the window before revocation — serious and
-recoverable — not funds.
+---
 
-The reasoning, the provider model, the rotation procedure, and the alerting
-signals are in
-[`docs/adr/0001-soroban-signing-key-custody.md`](docs/adr/0001-soroban-signing-key-custody.md).
+## Acknowledgements
 
-**If you find key material in source, logs, or an error response, treat it as a
-vulnerability** and report it through the private process above rather than
-opening an issue.
+Security reporters who responsibly disclose confirmed vulnerabilities will be credited in the relevant release notes (unless they prefer to remain anonymous).