- semgrep for sast check by yml rules - dependabot for package detection - update CICD doc - clippy -D unsafe_code hard fail