moai-ref-secops

Pin the pipeline definition and third-party actions by version or digest, use least-privilege per-job tokens, run jobs on ephemeral isolated runners, and sign produced artifacts. Gate deploys behind protected branches and audit-log every run with trigger identity and artifact digest.

Run containers as non-root with a read-only root filesystem, drop all Linux capabilities, apply the RuntimeDefault seccomp profile, and disable privileged mode and privilege escalation. Enforce this baseline at admission with PodSecurity restricted profile so violating pods are rejected before running.

BOLA defense requires a server-side ownership check on every object access; the client-supplied object ID is never trusted as authorization. Detect it in production by monitoring for identities accessing object IDs outside their expected set.

No. The Skill is strictly defensive: it describes misconfigurations, how to detect them, and how to prevent them. It cites MITRE ATT&CK technique IDs only to correlate defenses with the techniques they counter, never to provide exploitation procedures.

Scan IaC before the apply stage, as a CI gate between plan and apply, failing closed on high-severity findings like public buckets or wildcard IAM policies. A scan that runs after apply is detection, not prevention.

This Skill covers the operational runtime surface: production BOLA detection, gateway rate limiting, WAF tuning, and live query-depth limits. moai-ref-owasp-checklist covers dev-time secure coding such as parameterized queries, input validation, and security headers.