secure-sdlc

name	secure-sdlc
description	Use when integrating security into the software development lifecycle. Covers security gates, shift-left security, DevSecOps practices, security champions programs, and security review processes. USE FOR: secure SDLC, DevSecOps, shift-left security, security gates, security review, security champions, SDL, security requirements, security architecture review DO NOT USE FOR: specific security tools (use security-testing), threat modeling methodology (use threat-modeling), compliance frameworks (use data-protection)
license	MIT
metadata	{"displayName":"Secure SDLC","author":"Tyler-R-Kendrick"}
compatibility	claude, copilot, cursor
references	[{"title":"OWASP Software Assurance Maturity Model (SAMM)","url":"https://owaspsamm.org"},{"title":"NIST Secure Software Development Framework (SSDF)","url":"https://csrc.nist.gov/projects/ssdf"},{"title":"Microsoft Security Development Lifecycle","url":"https://www.microsoft.com/en-us/securityengineering/sdl"}]

Secure SDLC

Overview

Security must be built in, not bolted on. The concept of "shift-left security" means moving security considerations earlier in the software development lifecycle rather than treating them as a late-stage afterthought. When security is integrated from the very beginning — during requirements gathering and design — vulnerabilities are caught sooner, remediation costs are lower, and the resulting software is fundamentally more resilient. A secure SDLC ensures that every phase of development includes deliberate security activities, reviews, and gates.