Security Gates
Enforce approved intent at merge.

Establish a PR gate that evaluates approved requirements and triaged findings, enforce policy outcomes: block, warn, or exception.

Enforce only what your team approved.

Policies are built from verified requirements and exploitability evidence. CI receives a clear enforcement decision for every release candidate.

Security Gates · Policy board
2 in block mode
0Pass
1Block
2Warn
3Exception
Block
No critical exploitable findings
Exploitability Triage · EXP-01 · SQL injection in admin refund search
Block
Block
No hardcoded secrets in changed files
Secrets scan · payments-api/config.go
Block
Warn
RBAC coverage on new endpoints
Code Verification · REC-F11-R02 · AuthZ coverage below threshold
Warn
Pass
Security design review complete
SDR-14 · approved · 12 requirements verified
Pass
95%
Merge checks auto-evaluated
14
Active merge policies
180
Gate evaluations (last 30d)
7
Builds held for review