Skip to main content Skills Marktplatz Entdecken und erkunden Sie KI-Skills, die von der Community erstellt wurden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Prompt-Details anzeigen Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/diegosouzapw/awesome-omni-skill --skill secure-development-lifecycleDer Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
ZIP herunterladen Herunterladen... Mehr aus diesem Repository
Verwandte Berufe SOC
Basierend auf der SOC-Berufsklassifikation
name secure-development-lifecycle description Comprehensive SDLC security covering planning, development, testing, deployment, and maintenance with classification-driven controls and AI governance license Apache-2.0
🛡️ Secure Development Lifecycle (SDLC) Skill
🎯 Purpose
Comprehensive security practices for the entire Software Development Lifecycle (SDLC), ensuring security is built in from inception through maintenance. Integrates classification-driven requirements, AI-augmented development controls, and systematic testing frameworks aligned with Hack23 Secure Development Policy.
🔐 Core Security Principles
🔐 Security by Design
🏷️ Project Classification : CIA triad, RTO/RPO, business impact analysis🛡️ Secure Coding Standards : OWASP Top 10 alignment with classification controls🏗️ Architecture Documentation : SECURITY_ARCHITECTURE.md + FUTURE_SECURITY_ARCHITECTURE.md
🌟 Transparency Through Documentation
📋 Living Security Architecture : Real-time documentation with classification controls🎖️ Public Security Badges : OpenSSF Scorecard, SLSA, Quality Gate validation🔓 Open Development : Demonstrating expertise while maintaining classification
🔄 Continuous Security Improvement
🏷️ Classification-Driven Testing : SAST/SCA/DAST per classification levels📈 Performance Monitoring : Security metrics with availability SLAs🔍 Regular Reviews : Classification-based risk management and ROI
🔄 5-Phase SDLC Security Framework
📋 Phase 1: Planning & Design
🏷️ Project Classification (REQUIRED) Level Confidentiality Integrity Availability Security Investment Critical State secrets Financial <1 hour RTO Maximum controls High Proprietary Legal 4 hour RTO Strong controls Medium Internal Operational 24 hour RTO Standard controls Low Public Informational 72 hour RTO Baseline controls
🏗️ Security Architecture Design (REQUIRED) Maintain comprehensive architecture documentation:
🎯 Threat Modeling (MANDATORY)
💻 Phase 2: Development
🛡️ Secure Coding Guidelines OWASP Top 10 (2021) Alignment:
A01 - Broken Access Control : Proper authentication/authorizationA02 - Cryptographic Failures : TLS 1.3, AES-256 encryptionA03 - Injection : Parameterized queries, input validationA04 - Insecure Design : Apply threat modeling, secure patternsA05 - Security Misconfiguration : Secure defaults, hardened configsA06 - Vulnerable Components : SCA scanning, SBOM generationA07 - Authentication Failures : MFA, secure session managementA08 - Software/Data Integrity : Code signing, integrity checksA09 - Logging Failures : Comprehensive security event loggingA10 - SSRF : Validate external resource requests
🔍 Code Review Requirements Classification-Based Review:
Classification Review Type Required Approvals Security Focus Critical Formal security review 2+ reviewers + security architect All OWASP Top 10 High Security-focused PR review 2+ reviewers Critical vulnerabilities Medium Standard PR review 1+ reviewer Input validation, auth Low Standard PR review 1 reviewer Basic security checks
🔐 Secret Management (MANDATORY)
🧪 Phase 3: Security Testing
🔬 Static Application Security Testing (SAST)
Tool : SonarCloud integration on every commitQuality Gates : Classification-based failure thresholdsCoverage : All code analyzed for security vulnerabilitiesReporting : Public quality/security dashboards Classification-Based Quality Gates:
Classification Security Hotspots Code Coverage Duplications Maintainability Critical 0 (block) ≥90% <3% A rating High ≤2 (review) ≥80% <5% A or B rating Medium ≤5 (track) ≥70% <10% B or C rating Low ≤10 (monitor) ≥60% <15% C rating
📦 Software Composition Analysis (SCA) Severity Critical Project High Project Medium Project Low Project Critical 24 hours 72 hours 1 week 2 weeks High 1 week 2 weeks 1 month 2 months Medium 1 month 2 months 3 months 6 months Low Next release Next release Next release Next release
⚡ Dynamic Application Security Testing (DAST) Runtime Security Testing:
Tool : OWASP ZAP, Burp Suite, or equivalentScope : Staging environments (classification-appropriate)Frequency : Per sprint (Critical/High), quarterly (Medium/Low)Coverage : All authentication, authorization, input handling paths
🔍 Secret Scanning (CONTINUOUS)
📋 Test Data Protection (MANDATORY)
🎯 Unit Test Coverage & Quality
📊 Testing Standards
Line Coverage : ≥80% (Critical/High), ≥70% (Medium/Low)Branch Coverage : ≥70% (Critical/High), ≥60% (Medium/Low)Mutation Testing : ≥60% mutation score (Critical only)Test Execution : Every commit and PRTrend Analysis : Historical tracking, regression prevention
📚 Required Documentation Every repository MUST have:
📊 Reference Implementation Examples
🌐 End-to-End Testing Strategy
🎯 E2E Testing Requirements
📚 Required Documentation Every repository MUST have:
📊 Reference Implementation Examples 🏛️ Citizen Intelligence Agency:
🎮 Black Trigram:
📊 CIA Compliance Manager:
🤖 AI-Augmented Development Controls
🔐 AI as Proposal Generator, Not Authority
📋 PR Review Requirements
🔧 Curator-Agent Configuration Management
Scope : .github/agents/*.md, .github/copilot-mcp*.json, .github/workflows/copilot-setup-steps.ymlClassification : Normal Change per Change Management Approval : CEO or designated security owner requiredRisk Assessment : Documented evaluation for capability expansion
🛡️ Security Requirements
🚀 Phase 4: Deployment
🤖 Automated CI/CD Pipelines
✅ Manual Approval Gates Classification-Based Approvals:
Classification Approval Required Approvers Change Window Critical Production deploy CEO + Security Architect Scheduled only High Production deploy Tech Lead + Reviewer Standard window Medium Production deploy Automated + monitoring Anytime Low Production deploy Automated Anytime
📋 Deployment Checklists Pre-Deployment Verification:
📊 Security Metrics
🔧 Phase 5: Maintenance & Operations
🆘 Vulnerability Management Severity Critical Project High Project Medium Project Low Project Critical 24 hours 72 hours 1 week 2 weeks High 1 week 2 weeks 1 month 2 months Medium 1 month 2 months 3 months 6 months Low Next release Next release Next release Next release
📈 Performance Monitoring
🔄 Regular Updates
📋 Incident Response
📊 SDLC Security Maturity Levels
Level 1: Basic (Minimum Viable Security)
✅ Basic security controls implemented
✅ Dependabot enabled
✅ Secret scanning active
✅ Basic threat model documented
Level 2: Intermediate (Standard Security)
✅ Level 1 + Classification implemented
✅ SAST/SCA integrated in CI/CD
✅ Unit test coverage ≥70%
✅ SECURITY_ARCHITECTURE.md maintained
✅ Regular vulnerability scanning
Level 3: Advanced (Enhanced Security)
✅ Level 2 + DAST implementation
✅ Comprehensive threat modeling (STRIDE + MITRE ATT&CK)
✅ Unit test coverage ≥80%
✅ E2E testing framework
✅ Public security dashboards
Level 4: Mature (Security Excellence)
✅ Level 3 + AI-augmented development controls
✅ Mutation testing (≥60% score)
✅ Full C4 architecture documentation
✅ Continuous security monitoring
✅ Evidence-based compliance (badges, reports)
✅ External security validation (pentesting, audits)
✅ SDLC Security Checklist
Planning & Design Phase
Development Phase
Testing Phase
Deployment Phase
Maintenance Phase
📚 References
Hack23 ISMS Core Policies
Example Implementations
External Frameworks
🎯 Remember
Classification Drives Security : All requirements aligned with business impactTransparency is Competitive Advantage : Public security demonstrates expertiseAI Augments, Humans Decide : AI proposals require human approvalEvidence-Based Security : Badges, dashboards, reports validate claimsContinuous Improvement : Measure, analyze, improve security postureDocumentation is Mandatory : SECURITY_ARCHITECTURE.md, THREAT_MODEL.md requiredTesting is Not Optional : Unit + E2E coverage proves qualitySecurity is Everyone's Responsibility : DevSecOps culture required
Last Updated : 2026-02-10 (Continuous)Version : Based on Hack23 Secure Development Policy v2.1 & STYLE_GUIDE v2.3
