═══════════════════════════════════════════════════════════════════════════
  PCI DSS PREGUNTA 37 — PAQUETE DE EVIDENCIA
  Revisión de código + SAST + Branch protection
═══════════════════════════════════════════════════════════════════════════

PCI DSS Q37 (PCI v4 Req 6.2.3 + 6.2.4) requiere:
  - Registros de cambios recientes
  - Informes de revisión de código automatizados/manuales
  - Vulnerabilidades comunes abordadas en técnicas de coding
    (OWASP Top 10, SANS CWE Top 25, CERT Secure Coding)
  - Manual reviews por personas DISTINTAS del autor original
  - Aprobado por dirección antes del lanzamiento

QSA solicitó: Muestra de reporte de revisión de código de algún aplicativo
              del alcance

═══════════════════════════════════════════════════════════════════════════
ESTADO DE LOS CONTROLES (post-hardening 2026-05-27)
═══════════════════════════════════════════════════════════════════════════

AUTOMATIZADO (corre en cada PR + push a main + weekly schedule)
  ✓ ESLint security plugins (15+ rules: CWE-22/78/79/95/119/208/338/352/915/1333)
  ✓ npm audit (FAIL on HIGH/CRITICAL dependency CVEs)
  ✓ CodeQL security-extended queries (100+ queries OWASP/CWE)
  ✓ Trivy + Grype container scanning
  ✓ PCI custom anti-pattern scan (PAN regex, PAN logging, hardcoded secrets)

MANUAL (enforced via branch protection)
  ✓ Branch protection en main: 1+ approving review obligatorio
  ✓ dismiss_stale_reviews: invalida aprobación al re-push del PR
  ✓ Linear history: no merge commits (squash only)
  ✓ No force-push allowed
  ✓ No branch deletion allowed
  ✓ Required_conversation_resolution: debes resolver todos los comments

GITHUB SECURITY FEATURES habilitadas
  ✓ Dependabot alerts (196 detectadas, ver Q33)
  ✓ Dependabot security updates (auto-PRs)
  ✓ Secret scanning (push protection enabled)
  ✗ GitHub Advanced Security (requiere $49/seat/mo — no contratado)
    → CodeQL corre pero upload-as-artifact en lugar de UI integration

═══════════════════════════════════════════════════════════════════════════
EJEMPLO REAL: PR #29 (mergeado 2026-05-27)
═══════════════════════════════════════════════════════════════════════════

Title:        chore(security): enable Dependabot automated security updates
Author:       gaf2419 (Gabriel Ureña, CTO, human)
State:        MERGED
Merged at:    2026-05-27T22:52:12Z
Merge commit: f40cb0008d23b63f36f1baa57ce0d2e5942f93f3
Branch:       chore/enable-dependabot → main
Lines:        +56 / -0
Status:       Dependabot YAML validation: SUCCESS

Process followed:
  1. Branch created (CTO)
  2. Commit via GitHub API (auto-signed)
  3. PR opened with description + test plan + references
  4. Status check (dependabot YAML validator) passed
  5. Reviewed + merged (admin override since CTO is also reviewer in this case)

═══════════════════════════════════════════════════════════════════════════
WORKFLOW SAST DETALLE (pci-sast-analysis.yml — 540 LOC)
═══════════════════════════════════════════════════════════════════════════

Triggers:
  - pull_request (paths: backend/**, frontend/**)
  - push to main
  - schedule: weekly Sunday 03:00 UTC
  - workflow_dispatch (manual)

Jobs:
  1. eslint-security
     - eslint-plugin-security@3
     - eslint-plugin-no-unsanitized@4
     - @microsoft/eslint-plugin-sdl@0
     - Fails on errors

  2. npm-audit
     - npm audit --omit=dev --audit-level=high
     - Fails on HIGH/CRITICAL

  3. codeql
     - languages: javascript-typescript
     - queries: security-extended (100+ queries)
     - upload: never (no Advanced Security)
     - SARIF as artifact

  4. pci-antipatterns
     - Hardcoded PAN regex (Visa/MC/Amex)
     - PAN logging detection
     - Direct DB queries without TenantContext
     - Hardcoded secrets (passwords, API keys, Stripe)
     - Fails on matches

═══════════════════════════════════════════════════════════════════════════
CONTENIDO DEL PAQUETE
═══════════════════════════════════════════════════════════════════════════

  00-README.txt                  (este archivo)
  01-branch-protection.txt       Configuración branch protection main
  02-recent-prs.txt              Últimos 5 PRs mergeados con metadata
  03-pr29-detail.json            PR #29 detail completo (autor, checks, merge)
  04-workflows.txt               Inventario .github/workflows + SAST detail

═══════════════════════════════════════════════════════════════════════════
Fecha de extracción: 2026-05-27
Extraído por: Gabriel Ureña (CTO Fintrixs SAS)
═══════════════════════════════════════════════════════════════════════════
