القائمة
Use when embedding security into the SDLC, mapping to NIST SSDF, or defining security gates. Triggers on 'secure SDLC', 'SSDF', 'security gates', 'shift left', 'paved road', 'security checkpoints'.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
"Use when validating requirements against EARS notation patterns. Triggers on "EARS", "requirement review", "requirement quality", "shall statement", "REQ-ID"."
"Use when mapping business capabilities, identifying overlap or gaps across the enterprise, or aligning IT investments to business outcomes. Triggers on "capability map", "business capability", "domain map", "enterprise architecture"."
"Use when drafting Architecture Decision Records, evaluating alternatives, or documenting technical trade-offs. Triggers on "ADR", "architecture decision", "trade-off", "pick between", "why did we choose"."
"Use when a new engineer joins the team, when onboarding to an unfamiliar codebase, or when auditing whether the team has shared understanding. Triggers on "onboard", "context", "knowledge gap", "bus factor", "team understanding"."
Use when refactoring legacy code, extracting a service, or making behavior-preserving changes. Triggers on 'refactor', 'legacy code', 'strangler fig', 'characterization test', 'mikado method'.
Use when practicing test-driven development, writing a failing test first, or coaching red-green-refactor. Triggers on 'TDD', 'red-green-refactor', 'test first', 'failing test', 'write a test'.
| name | Secure SDLC |
| description | Use when embedding security into the SDLC, mapping to NIST SSDF, or defining security gates. Triggers on 'secure SDLC', 'SSDF', 'security gates', 'shift left', 'paved road', 'security checkpoints'. |
| Phase | Control | Gate |
|---|---|---|
| Plan / design | Threat model on material changes | Design review sign-off |
| Code | Pre-commit hooks (secret scan, linter) | Blocks commit |
| PR | SAST, SCA, IaC scan | Required status check |
| Build | SBOM, container scan, signing | Fails build on Critical |
| Pre-prod | DAST on deployed env, config review | Release gate |
| Release | Signed artifact + provenance verified on deploy | Deploy-time policy |
| Run | Runtime monitoring, WAF, anomaly detection | 24/7 on-call |
| Respond | IR runbook, disclosure process | Tested quarterly |
Every control in your SDLC should trace to one of these.
Developers choosing the paved road get gates mostly for free. Off-road requires additional review.
