Ch11. 보안과 코드 거버넌스

# .github/CODEOWNERS
# 전체 기본 리뷰어
* @acme/engineering-leads

# 앱별 소유자
/apps/web/          @acme/frontend-team
/apps/admin/        @acme/frontend-team

# 패키지별 소유자
/packages/db/       @acme/backend-team @acme/platform-team
/packages/ui/       @acme/design-system-team
/packages/types/    @acme/backend-team
/packages/utils/    @acme/platform-team

# 인프라/설정 — 플랫폼팀 승인 필수
/turbo.json         @acme/platform-team
/.github/           @acme/platform-team
/package.json       @acme/platform-team

// renovate.json (추천 설정)
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "group:monorepos",
    ":automergeMinor",
    ":automergePatch"
  ],
  "packageRules": [
    {
      "groupName": "devDependencies",
      "matchDepTypes": ["devDependencies"],
      "automerge": true
    },
    {
      "groupName": "major updates",
      "matchUpdateTypes": ["major"],
      "automerge": false
    }
  ]
}

# 스킬 설치
npx add-skill trailofbits/static-analysis
npx add-skill trailofbits/differential-review

// packages/eslint-config/base.js
import security from 'eslint-plugin-security';

export default [
  security.configs.recommended,
  {
    rules: {
      'security/detect-object-injection': 'warn',
      'security/detect-non-literal-regexp': 'warn',
      'security/detect-possible-timing-attacks': 'error',
    },
  },
];

# .gitignore — 시크릿 파일 차단
.env
.env.local
.env.*.local
*.pem
*.key

# .github/workflows/ci.yml — 시크릿 사용
env:
  DATABASE_URL: ${{ secrets.DATABASE_URL }}
  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}

// .claude/settings.json
{
  "permissions": {
    "allow": [
      "Read",
      "Write",
      "Edit",
      "Glob",
      "Grep",
      "Bash(yarn:*)",
      "Bash(turbo:*)",
      "Bash(git:*)",
      "Bash(npx vitest:*)",
      "Bash(npx playwright:*)"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(curl:*)",
      "Bash(wget:*)"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "command": "echo '$CLAUDE_TOOL_INPUT' | jq -r '.command' | grep -qiE '(DROP|DELETE FROM|TRUNCATE|rm -rf /)' && echo 'BLOCK: 파괴적 명령 차단' && exit 1 || exit 0"
      }
    ]
  }
}

// Graduated Autonomy 구현 예시 (.claude/settings.json)
{
  // Level 2: 알림 기반
  "permissions": {
    "allow": [
      "Read", "Write", "Edit", "Glob", "Grep",
      "Bash(yarn:*)", "Bash(turbo:*)", "Bash(git:*)"
    ],
    "deny": ["Bash(rm -rf:*)", "Bash(curl:*)", "Bash(docker:*)"]
  },
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Bash",
        "command": "echo '[알림] 에이전트 Bash 실행: $CLAUDE_TOOL_INPUT' | notify-slack"
      }
    ],
    "PreToolUse": [
      {
        "matcher": "Bash",
        "command": "echo '$CLAUDE_TOOL_INPUT' | jq -r '.command' | grep -qiE '(DROP|DELETE FROM|TRUNCATE)' && echo 'BLOCK: Level 2 정책 위반' && exit 1 || exit 0"
      }
    ]
  }
}