CI/CD Pipeline

1. Build → Unit tests → Integration tests → Security scans.
2. Deploy to staging → Smoke tests → Manual approval (if needed).
3. Prod deploy with canary or blue/green + automatic rollback.

Use managed secrets, never commit keys. Rotate on schedule and on breach suspicion.