Skip to main content

Automated debt & security scanning pipeline

The STOP audits, wired in so they run forever. The tech-debt audit and security-gap assessment produce a baseline once; this standard keeps that baseline alive — SAST, SCA and secrets scanning run in CI on every legacy repo, and findings flow straight into the registers. Without it, the audit is a photograph that starts rotting the day it's taken.

The scans​

  • SAST on every commit — zero criticals per the security gates; highs land in the security-debt register with a fix-by SLA.
  • SCA on every commit plus a scheduled full pass — the scheduled pass matters because dependency risk changes without the code changing: a new CVE against an old lockfile is a new finding. Feeds the security-debt register and the EOL inventory.
  • Secrets scanning — full history on first enablement (that first pass is step one of the secrets sweep), incremental and zero-tolerance thereafter (secrets management).
  • Static quality analysis on a schedule — complexity, duplication and churn-vs-complexity hotspot deltas, feeding the tech-debt register so debt findings stay current, not frozen at audit date.

Findings auto-feed the registers​

  • A finding that isn't a register row doesn't exist. Scanner output lands as rows in the tech-debt and security-debt registers automatically — with evidence links and scoring inputs (CVSS/EPSS for security; complexity and churn for debt) ready for remediation-backlog triage.
  • Deduplicated, not duplicated — a finding seen on ten commits is one row updated, not ten rows. A remediated finding closes its row; a regressed one reopens it.
  • The registers are the record; scanner dashboards are views. No parallel truth in five tool UIs — triage, SLAs and risk acceptances all happen against the registers.
  • New repos get this free — the scaffold CI template has these stages built in. This standard exists for the legacy estate, where the scans must be retrofitted.

Rollout​

Enable in read-only/report mode first so the registers seed without blocking anyone, then ratchet to blocking thresholds per repo as criticals clear — going straight to blocking on a legacy repo just teaches teams to route around CI.

Blocked on legacy repo access

Rollout needs read access to every legacy repo and its pipelines, and CI minutes on estates we may not control (some legacy insurer platforms are vendor-hosted). A named owner must secure that access per product — until then this standard applies only to repos we can reach, and the gap list is itself a register entry.

Pending tooling selection

Concrete SAST/SCA/secrets tools are placeholders until the tooling evaluation selects them. The register schemas and zero-critical policy above are tool-agnostic and stand now.

Standards referenced: NIST SSDF (PW.7/PW.8, RV.1 — continuous code verification and vulnerability identification, rather than point-in-time review).