Security review

Who it is for

You review the identities and approvals behind each update before plywood runs.

Features

• Preview and update run as separate cloud identities
• The OIDC trade happens before the pull request's code is checked out
• Approvals can be signed, and each binds one preview digest
• Policy and approvers are read at base

Every setup gets

• One preview note on every pull request
• Updates of the previews you approved
• No overlapping or stale updates
• Re-preview from a comment
• Scheduled drift checks
• Separate identities to preview and to update
• Policy on every preview, CrossGuard included
• An audit trail in your own repository
• Secrets stay [secret] in notes
• Your backend and your runners, as they are

First step

Threat model

Then read

How-to

Scope state and cloud accessApprovals runbook

Explanation

Approvals are records

Reference

Threat modelVersions and pins