qa(security): add security coverage (deny/audit/gitleaks/fuzz/authz/SBOM)

.github/gitleaks.toml

@@ -0,0 +1,23 @@
+title = "rustle gitleaks"
+
+[allowlist]
+paths = [
+  "target/",
+  "**/target/",
+  "frontend/dist/",
+  "dist/",
+  "tests/ui/node_modules/",
+  "tests/ui/playwright-report/",
+  "tests/ui/test-results/",
+  "**/Cargo.lock",
+  "frontend/src/constants/wordlist.txt",
+  "frontend/src/constants/valid_guesses.txt",
+  "frontend/src/helpers/word_db.rs",
+]
+
+regexes = [
+  { id = "uuid-v4", regex = "[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}" },
+]
+
+[extend]
+useDefault = true

.github/workflows/security.yml

@@ -0,0 +1,134 @@
+name: security
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  deny:
+    name: cargo-deny
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: cargo-deny install
+        run: |
+          cargo install --locked cargo-deny --version "^0.16"
+
+      - name: cargo-deny check
+        env:
+          CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+        run: |
+          if [ ! -f deny.toml ]; then
+            cargo deny --init >/dev/null
+          fi
+          cargo deny check
+
+  audit:
+    name: cargo-audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: cargo-audit install
+        run: |
+          cargo install --locked cargo-audit --version "^0.21"
+
+      - name: cargo-audit run
+        env:
+          CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+        run: |
+          cargo audit --deny warnings
+
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: gitleaks scan
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_CONFIG: .github/gitleaks.toml
+
+  fuzz-smoke:
+    name: fuzz smoke (build only)
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust nightly
+        uses: dtolnay/rust-toolchain@nightly
+        with:
+          targets: x86_64-unknown-linux-gnu
+
+      - name: cargo-fuzz install
+        run: |
+          cargo install --locked cargo-fuzz --version "^0.13"
+
+      - name: Build fuzz_scorer
+        env:
+          CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+        run: |
+          cargo +nightly fuzz build fuzz_scorer
+
+  sbom:
+    name: SBOM (CycloneDX)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: cargo-cyclonedx install
+        run: |
+          cargo install --locked cargo-cyclonedx --version "^0.5"
+
+      - name: Generate SBOM
+        env:
+          CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+        run: |
+          cargo cyclonedx --format json --override-filename root-cargo > /tmp/sbom.json || true
+          if [ -s /tmp/sbom.json ]; then
+            mkdir -p artifacts
+            cp /tmp/sbom.json artifacts/sbom.cargo.json
+          fi
+          cargo cyclonedx --all --format json --override-filename workspace-cargo -p backend -p rustle-frontend > /tmp/sbom-ws.json || true
+          if [ -s /tmp/sbom-ws.json ]; then
+            cp /tmp/sbom-ws.json artifacts/sbom.workspace.cargo.json
+          fi
+
+      - name: Upload SBOM
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: rustle-sbom
+          path: artifacts/
+          retention-days: 14

Cargo.toml

@@ -3,6 +3,7 @@ members = [
     "backend",
     "frontend"
 ]
+exclude = ["fuzz"]
 resolver = "2"
 
 [profile.release]

backend/Cargo.toml

@@ -32,3 +32,7 @@ shared-core = { git = "https://github.com/studio2201/shared-assets.git", tag = "
 shared-backend = { git = "https://github.com/studio2201/shared-assets.git", tag = "v3.0.33" }
 [dev-dependencies]
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "cookies"] }
+tower = { version = "0.5", features = ["util"] }
+http-body-util = "0.1"
+hyper = { version = "1", features = ["full"] }
+shared-backend = { git = "https://github.com/studio2201/shared-assets.git", tag = "v3.0.33" }

backend/src/lib.rs

@@ -0,0 +1,20 @@
+// Copyright (C) 2026 UberMetroid
+//
+// This file is part of Rustle.
+//
+// Rustle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Rustle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Rustle.  If not, see <https://www.gnu.org/licenses/>.
+
+pub mod auth;
+pub mod routes;
+pub mod utils;