Security Review Quickstart

Use this checklist to validate DriftGate control-plane claims in under 10 minutes.

1) Verify Auth Contract

• Runtime endpoints require bearer session auth:
  • POST /sessions.start
  • POST /sessions/{sessionId}/executions.execute
  • POST /execute
• Admin/config operations use service-account API key auth:
  • x-driftgate-api-key: dgk_...
• dg_sa_* is never a credential secret.

Reference: Auth + Token Contract

2) Verify Token Lifecycle Controls

1. Create service account in Identity -> Service Accounts.
2. Mint token and copy dgk_* secret once.
3. Confirm admin/config call succeeds (for example policies list).
4. Revoke token and confirm subsequent call is rejected.

3) Verify Runtime Credential Separation

• Confirm runtime commands reject dgk_* with AUTH_INVALID/missing session token.
• Confirm runtime succeeds with driftgate login session token.

4) Verify Evidence Packet

• Launch gate summary: tmp/release-gate/out/release-gate-summary.json
• Launch evidence packet: tmp/launch-evidence/launch-evidence-<sha>.json
• Runtime security checks: prod-runtime-security, prod-smoke, cutover-drills run evidence

If any of the five checks above fail, treat release status as NO-GO.