PR opened

G1: Unit • SAST • SCA

G2: Build & SIGN artifact (artifact + hash + sig + SBOM)

G3: Deploy to STAGING (blue)

G4: E2E • DAST • PERF (p95/p99 SLOs)

G5: CANARY 5–10% traffic (error budget guards)

Auto-ROLLBACK hooks

G6: Full rollout (blue→green)

Browser (Public)

CDN/WAF + Bot Mgmt (Edge/Public) - WAF rules, rate limits, device/IP reputation

App/API (Blue & Green) (Private/VPC) - ABAC/RBAC, validation/encoding, CSRF, session mgmt

Auth (OIDC) (External)

Payments Gateway (Hosted) (External)

Cache / DB

MQ / Workers

Observability: APM, logs, metrics, RUM

DB Primary (PostgreSQL) (KMS keys, private SG)

DB Replica (RO) (reads only)

Cache (Redis) (private SG; auth)

Object Storage (S3/Bucket) (presigned URLs; AV scan; KMS)