secure-development-lifecycle

name	secure-development-lifecycle
description	Comprehensive SDLC security practices with DevSecOps automation, OWASP Top 10, supply chain security (OSSF/SLSA)
license	Apache-2.0

Secure Development Lifecycle Skill

Purpose

Implement secure development practices across all SDLC phases for TypeScript/Node.js MCP server development, from requirements through deployment.

When to Use

• ✅ Planning new features with security requirements
• ✅ Implementing security controls in code
• ✅ Configuring CI/CD security gates
• ✅ Conducting security reviews before release
• ✅ Managing supply chain security

SDLC Security Phases

1. Requirements

• Define security requirements alongside functional requirements
• Identify data classification (European Parliament public data, GDPR considerations)
• Determine compliance requirements (ISMS, GDPR)

2. Design

• Threat modeling using STRIDE methodology
• Security architecture documentation (SECURITY_ARCHITECTURE.md)
• Input validation strategy (Zod schemas)
• Rate limiting and API security design

3. Implementation

// Security controls in code
import { z } from 'zod';

// Input validation
const schema = z.object({
  id: z.number().int().positive(),
  query: z.string().min(1).max(500),
});

// Error handling (no information leakage)
try {
  const result = await apiCall();
} catch (error) {
  logger.error('API call failed', { error });
  throw new Error('Request failed');  // Generic message
}

4. Testing

• Unit tests with 80%+ coverage
• Security-focused tests (input validation, error handling)
• Dependency scanning (npm audit)
• License compliance (test:licenses)

5. Deployment

• Automated security checks in CI/CD
• CodeQL analysis on every PR
• SBOM generation for supply chain transparency
• Signed releases with provenance attestation

6. Monitoring

• Dependabot alerts for dependency vulnerabilities
• GitHub secret scanning
• Regular security audits

Supply Chain Security

Control	Implementation
OSSF Scorecard	Automated scoring of security practices
SLSA Level	Build provenance and supply chain integrity
SBOM	CycloneDX software bill of materials
Dependency pinning	package-lock.json committed
Signed commits	GPG-signed git commits

ISMS Policy References

Core SDLC policies:

• Information Security Policy — Governance and security-by-design mandate
• Secure Development Policy — SDLC phases, DevSecOps controls, test / SBOM / SLSA obligations
• Open Source Policy — Supply-chain security, licensing, vulnerability disclosure, SBOM publication

Supporting policies:

• Change Management — Controlled, reviewed, reversible changes
• Vulnerability Management — CVSS-based SLAs (Critical 7d / High 30d / Medium 90d / Low 180d)
• Cryptography Policy — Approved algorithms, TLS 1.3+, key management
• Access Control Policy — Least privilege in CI/CD tokens and runtime
• Threat Modeling — STRIDE at design phase
• Incident Response Plan — Response to CI/CD / supply-chain incidents
• AI Policy + OWASP LLM Security Policy — AI-assisted development and MCP-specific hardening