Security gates
Security is checks built into the flow, not a final review meeting. Each check is named, placed in the pipeline, given a pass/fail threshold, and assigned override rights — so "secure" is verified continuously, not hoped for at the end.
The checks, by place in the flow
| When | Check | Threshold |
|---|---|---|
| Every commit | Secrets scan | Zero secrets |
| Every commit | SAST | Zero criticals |
| Every commit | SCA (dependency CVEs) | Zero criticals; highs triaged |
| Build | IaC scanning | Zero criticals |
| Refinement | ASVS spot-check | L2 checklist passes |
| Before Production | DAST | Zero criticals |
| Before Production | Provenance / SBOM checks | Signed artefact, complete SBOM |
Rules
- Built into CI/CD, wired to the merge gate and Production Readiness — not a separate sign-off meeting.
- Security-critical findings are never waivable. Other findings follow the waiver process — time-boxed, named approver, logged, expiring — recorded in the security exception register.
- The deploy is human-authorised regardless of green gates — it's an irreversible action.
Standards referenced: OWASP SAMM, ASVS, SLSA. This standard sits beneath the threat-modelling playbook (which decides what to defend) and the secure-by-default standard (which builds it in).