🛡️ 7-Layer Unified Security Model

A comprehensive security strategy requires defense at every layer

7
Security Layers
48
ShipGuard Rules
6
Language Stacks
4
Severity Levels

Layer 7: Observability & Incident Response

RUNTIME
▼

Detect and respond to security incidents in production

📊 SIEM (Splunk, ELK)
🚨 Alerting (PagerDuty)
📈 Monitoring (Datadog)
📋 Logging & Audit
Stage: Production
ShipGuard: No direct coverage (runtime phase)

Layer 6: Supply Chain Integrity

BUILD & DEPLOY
▼

Ensure build artifacts and dependencies are properly pinned and trustworthy

🐳 Pinned container images
📌 Locked dependencies
✍️ Artifact signing (Sigstore)
🔍 Image scanning
Stage: CI/CD & Deployment
✅ ShipGuard: SC-001..SC-004 (Docker pinning, dependency pinning, lockfile safety, .gitignore baseline)

Layer 5: DAST (Dynamic Testing)

TESTING
▼

Find runtime vulnerabilities by testing the running application

🔧 OWASP ZAP
🔒 Burp Suite
🎯 API fuzzing
🧪 Penetration testing
Stage: Testing/Staging
ShipGuard: No direct coverage (requires running app)

Layer 4: AI Reasoning

REVIEW
▼

Use semantic understanding and architectural knowledge to find complex vulnerabilities

🤖 Claude / GPT-4
👥 Human architects
🏗️ Threat modeling
🔐 Authorization review
Stage: Code Review
ShipGuard: No direct coverage (manual process)

Layer 3: SAST (Static Analysis)

PRIMARY
▼

Find code vulnerabilities without executing the application

🔍 Command injection
🛣️ Path traversal
💉 SQL injection
✂️ XXE attacks
🔐 Weak crypto
🚫 Unsafe deserialization
Stage: Development
✅ ShipGuard: 34 SAST rules (SHELL-001-009, PY-001-009, JS-001-008, GHA-001-005, CFG-001-003)

Layer 2: Secrets Management

PREVENTION
▼

Prevent hardcoded credentials and tokens from being committed

🔑 AWS keys
☁️ GCP tokens
🐙 GitHub tokens
🔐 DB passwords
Stage: Git & Pre-commit
✅ ShipGuard: SEC-001..SEC-010 (cloud/API credential and token patterns)

Layer 1: Dependencies

SUPPLY CHAIN
▼

Detect vulnerable or compromised dependencies before they reach production

🐍 pip-audit
📦 npm audit
🔎 osv-scanner
🛡️ Snyk
Stage: Package Selection
ShipGuard: No direct coverage (use external tools)

ShipGuard Coverage

ShipGuard provides primary coverage for Layers 3, 2, and 6:

Layer 3 (SAST): 34 rules across Shell, Python, JavaScript, GitHub Actions, and Config files
Layer 2 (Secrets): 10 rules (SEC-001..SEC-010) for cloud/API credentials and tokens
Layer 6 (Supply Chain): 4 rules (SC-001..SC-004) for Docker images, dependency pinning, lockfiles, and .gitignore baselines
Other Layers (1, 4, 5, 7): Use external tools or manual processes