ci: add security scanning workflow

.github/workflows/security.yml

@@ -1,21 +1,66 @@
-name: Security Review
-
-permissions:
-  pull-requests: write  # Needed for leaving PR comments
-  contents: read
+name: Security
 
 on:
+  push:
+    branches: [ main, develop ]
   pull_request:
 
 jobs:
-  security:
+  govulncheck:
+    name: Scan dependencies for vulnerabilities
     runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: stable
+
+      - name: Run govulncheck
+        uses: golang/govulncheck-action@v1
+        with:
+          go-version-input: stable
+
+  gosec:
+    name: Static security analysis
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run gosec
+        uses: securego/gosec@master
+        with:
+          args: -exclude-generated ./...
+
+  gitleaks:
+    name: Scan for committed secrets
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  security-review:
+    name: Claude security review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    permissions:
+      pull-requests: write  # Needed for leaving PR comments
+      contents: read
+
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 2
-      
+
       - uses: anthropics/claude-code-security-review@main
         with:
           comment-pr: true

README.md

@@ -31,7 +31,7 @@ Built as a learning project to demonstrate production-ready Go architecture for
 **Extensible Architecture**
 - Modular gRPC services for different data sources
 - Easy to add new adapters for exchanges or price feeds
-- REST API via gRPC-Gateway for external integrations
+- Connect-RPC serves REST and gRPC on a single endpoint for external integrations
 
 ---
 
@@ -73,15 +73,14 @@ cd greedy-eye
 make up
 make schema-apply
 
-# Servers:
-# HTTP API: http://localhost:8080
-# gRPC:     localhost:50051
+# Server (Connect-RPC over h2c — REST + gRPC on one port):
+# http://localhost:8080
 ```
 
 ### Health Check
 
 ```bash
-curl http://localhost:8080/health
+curl http://localhost:8080/eye/health
 ```
 
 ### Run Tests

cmd/eye/main.go

@@ -136,8 +136,9 @@ func run() error {
 
 	// Create server with h2c (HTTP/2 cleartext) support for Connect
 	server := &http.Server{
-		Addr:    fmt.Sprintf(":%d", config.Server.Port),
-		Handler: h2c.NewHandler(mux, &http2.Server{}),
+		Addr:              fmt.Sprintf(":%d", config.Server.Port),
+		Handler:           h2c.NewHandler(mux, &http2.Server{}),
+		ReadHeaderTimeout: 10 * time.Second, // mitigate Slowloris (gosec G112)
 	}
 
 	// Start server in background

go.mod

@@ -7,7 +7,7 @@ require (
 	github.com/getsentry/sentry-go v0.29.0
 	github.com/google/uuid v1.6.0
 	github.com/jackc/pgx-shopspring-decimal v0.0.0-20220624020537-1d36b5a1853e
-	github.com/jackc/pgx/v5 v5.8.0
+	github.com/jackc/pgx/v5 v5.9.2
 	github.com/knadh/koanf v1.5.0
 	github.com/shopspring/decimal v1.4.0
 	github.com/spf13/pflag v1.0.5
@@ -76,10 +76,10 @@ require (
 	go.opentelemetry.io/otel v1.38.0 // indirect
 	go.opentelemetry.io/otel/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
-	golang.org/x/crypto v0.47.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/crypto v0.48.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -190,8 +190,8 @@ github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7Ulw
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
 github.com/jackc/pgx-shopspring-decimal v0.0.0-20220624020537-1d36b5a1853e h1:i3gQ/Zo7sk4LUVbsAjTNeC4gIjoPNIZVzs4EXstssV4=
 github.com/jackc/pgx-shopspring-decimal v0.0.0-20220624020537-1d36b5a1853e/go.mod h1:zUHglCZ4mpDUPgIwqEKoba6+tcUQzRdb1+DPTuYe9pI=
-github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo=
-github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw=
+github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
+github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
@@ -390,8 +390,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
-golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
@@ -432,8 +432,8 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -471,19 +471,19 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
-golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20181227161524-e6919f6577db/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
-golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

internal/service/marketdata/handler.go

@@ -186,7 +186,7 @@ func (h *Handler) CreatePrices(ctx context.Context, req *connect.Request[apiv1.C
 	}
 
 	return connect.NewResponse(&apiv1.CreatePricesResponse{
-		CreatedCount: int32(count),
+		CreatedCount: int32(count), // #nosec G115 -- count of rows created, bounded by request size
 	}), nil
 }
 
@@ -435,8 +435,8 @@ func (h *Handler) FetchExternalPrices(ctx context.Context, req *connect.Request[
 	}
 
 	return connect.NewResponse(&apiv1.FetchExternalPricesResponse{
-		PricesFetched: int32(totalFetched),
-		PricesStored:  int32(stored),
+		PricesFetched: int32(totalFetched), // #nosec G115 -- count of fetched prices, bounded by request size
+		PricesStored:  int32(stored),       // #nosec G115 -- count of rows stored, bounded by request size
 		Errors:        fetchErrs,
 	}), nil
 }

internal/service/portfolio/convert.go

@@ -0,0 +1,38 @@
+package portfolio
+
+import "math"
+
+// Token decimals arrive from external chain metadata. They are tiny in practice
+// (<= ~36), but their wire types (uint32, int) permit values that would overflow
+// when narrowed to int32/uint32, which gosec flags as G115. These helpers clamp
+// to the target range so malformed metadata can never trigger a silent integer
+// overflow. Clamping rather than erroring is safe: an absurd decimals value
+// already yields meaningless amounts downstream, so the clamp only ever rewrites
+// input that was broken to begin with.
+
+func decI32(d uint32) int32 {
+	if d > math.MaxInt32 {
+		return math.MaxInt32
+	}
+	return int32(d)
+}
+
+func intToI32(n int) int32 {
+	if n > math.MaxInt32 {
+		return math.MaxInt32
+	}
+	if n < math.MinInt32 {
+		return math.MinInt32
+	}
+	return int32(n)
+}
+
+func intToU32(n int) uint32 {
+	if n < 0 {
+		return 0
+	}
+	if int64(n) > math.MaxUint32 {
+		return math.MaxUint32
+	}
+	return uint32(n)
+}

internal/service/portfolio/handler.go

@@ -197,7 +197,7 @@ func (h *Handler) CalculatePortfolioValue(ctx context.Context, req *connect.Requ
 		}
 
 		// value = (amount / 10^holding.Decimals) * unitPrice
-		holdingValue := hld.Amount.Shift(-int32(hld.Decimals)).Mul(unit)
+		holdingValue := hld.Amount.Shift(-decI32(hld.Decimals)).Mul(unit)
 		total = total.Add(holdingValue)
 	}
 
@@ -271,7 +271,7 @@ func (h *Handler) latestAnyBase(ctx context.Context, assetID string) (string, de
 			"asset_id", assetID, "base_asset_id", resp.Msg.BaseAssetId, "last", resp.Msg.Last, "error", err)
 		return "", decimal.Zero, false, nil
 	}
-	return resp.Msg.BaseAssetId, last.Shift(-int32(resp.Msg.Decimals)), true, nil
+	return resp.Msg.BaseAssetId, last.Shift(-decI32(resp.Msg.Decimals)), true, nil
 }
 
 // realPrice returns the latest price of assetID in baseID as a real-unit decimal
@@ -293,7 +293,7 @@ func (h *Handler) realPrice(ctx context.Context, assetID, baseID string) (decima
 			"asset_id", assetID, "base_asset_id", baseID, "last", resp.Msg.Last, "error", err)
 		return decimal.Zero, false, nil
 	}
-	return last.Shift(-int32(resp.Msg.Decimals)), true, nil
+	return last.Shift(-decI32(resp.Msg.Decimals)), true, nil
 }
 
 // GetPortfolioPerformance calculates return over a time range using stored price history.
@@ -342,7 +342,7 @@ func (h *Handler) GetPortfolioPerformance(ctx context.Context, req *connect.Requ
 			continue
 		}
 
-		divisorCurrent := decimal.New(1, int32(hld.Decimals)+int32(latestPrice.Decimals))
+		divisorCurrent := decimal.New(1, decI32(hld.Decimals)+decI32(latestPrice.Decimals))
 		holdingCurrent := hld.Amount.
 			Mul(latestLast).
 			Div(divisorCurrent)
@@ -372,7 +372,7 @@ func (h *Handler) GetPortfolioPerformance(ctx context.Context, req *connect.Requ
 			continue
 		}
 
-		divisorFrom := decimal.New(1, int32(hld.Decimals)+int32(fromPrice.Decimals))
+		divisorFrom := decimal.New(1, decI32(hld.Decimals)+decI32(fromPrice.Decimals))
 		holdingFrom := hld.Amount.
 			Mul(fromLast).
 			Div(divisorFrom)
@@ -649,7 +649,7 @@ func (h *Handler) SyncAccount(ctx context.Context, req *connect.Request[apiv1.Sy
 			continue
 		}
 		symbol := entity.NormalizeSymbol(b.Symbol)
-		qty := decimal.NewFromBigInt(amt, int32(-b.Decimals)) // raw / 10^decimals
+		qty := decimal.NewFromBigInt(amt, -intToI32(b.Decimals)) // raw / 10^decimals
 		if entry, ok := bySymbol[symbol]; ok {
 			entry.qty = entry.qty.Add(qty)
 			if b.Decimals > entry.decimals {
@@ -698,10 +698,10 @@ func (h *Handler) SyncAccount(ctx context.Context, req *connect.Request[apiv1.Sy
 	var assetsUpserted, holdingsUpserted int32
 
 	for symbol, entry := range bySymbol {
-		decimals := uint32(entry.decimals)
+		decimals := intToU32(entry.decimals)
 		// holdings.amount is NUMERIC: store the merged quantity as a raw integer at the
 		// holding's decimals scale (exact — qty has at most `decimals` fractional digits).
-		amount := entry.qty.Shift(int32(entry.decimals))
+		amount := entry.qty.Shift(intToI32(entry.decimals))
 
 		// Ensure asset exists
 		assetID, exists := symbolToAssetID[symbol]