Skip to main content
secure-development-policy Comprehensive secure development lifecycle covering all SDLC phases, AI controls, testing, and security requirements per Hack23 ISMS
설치로 이동 Skills Marketplace 커뮤니티가 만든 AI 스킬을 발견하고 탐색하세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/Hack23/riksdagsmonitor --skill secure-development-policy명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Zip 다운로드 다운로드 중... 이 저장소의 다른 Skills Master GitHub Agentic Workflows authoring - markdown syntax, natural language instructions, YAML frontmatter, compilation, and workflow patterns
Comprehensive expertise in GitHub Agentic Workflows (v0.68.1) — AI-powered repository automation with five-layer security, safe outputs, MCP tools, and Continuous AI patterns
github-agentic-workflows-mcp-configuration Comprehensive guide for MCP (Model Context Protocol) server setup, transport protocols, configuration validation, lifecycle management, tool discovery, and error handling patterns
SOC
name secure-development-policy description Comprehensive secure development lifecycle covering all SDLC phases, AI controls, testing, and security requirements per Hack23 ISMS license Apache-2.0
🛡️ Secure Development Policy Skill
🔴 AI FIRST Quality Principle
Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.
🎯 Purpose Statement
Apply Hack23 AB's Secure Development Policy to demonstrate how security-by-design creates competitive advantages through systematic DevSecOps implementation.
Reference: Hack23 Secure Development Policy
This skill provides comprehensive guidance for implementing all phases of the secure development lifecycle with clear, actionable requirements following STYLE_GUIDE.md icon standards.
🔄 Secure Development Lifecycle (SDLC) - All Phases
📋 Phase 1: Planning & Design
Clear Requirements:
✅ Complete project classification per Classification Framework
✅ Document CIA triad levels (Confidentiality, Integrity, Availability)
✅ Define RTO/RPO aligned with business impact
✅ Create SECURITY_ARCHITECTURE.md with Mermaid C4 diagrams
✅ Perform STRIDE threat modeling documented in THREAT_MODEL.md
✅ Complete risk assessment integrated with Risk Register
✅ Calculate security investment ROI based on classification
💻 Phase 2: Development
✅ Follow OWASP Top 10 secure coding standards
✅ Implement language-specific security best practices
✅ Require security-focused code review for all changes
✅ Apply data classification to all code assets
✅ Use GitHub secrets, never hardcode credentials
✅ Implement secret rotation procedures
✅ Use parameterized queries (no SQL injection)
✅ Validate and sanitize all inputs
✅ Encode outputs appropriately for context
✅ Implement proper error handling (no information disclosure)
Code Review Security Checklist:
🧪 Phase 3: Security Testing
🔬 SAST (Static Application Security Testing)
✅ SonarCloud integration on every commit
✅ Quality gate must pass (no Critical/High vulnerabilities)
✅ Security hotspots reviewed and resolved
✅ Code coverage ≥80% lines, ≥70% branches
📦 SCA (Software Composition Analysis)
✅ Automated dependency scanning (Dependabot/Renovate)
✅ SBOM generation (CycloneDX or SPDX format)
✅ License compliance via FOSSA scanning
✅ Vulnerability remediation per classification SLAs:
Critical: 24 hoursHigh: 7 daysMedium: 30 daysLow: 90 days
⚡ DAST (Dynamic Application Security Testing)
✅ OWASP ZAP scanning in staging environment
✅ API security testing (authentication, authorization, input validation)
✅ Annual penetration testing for High/Critical projects
🔍 Secret Scanning
✅ GitHub secret scanning enabled
✅ Pre-commit hooks prevent secret commits
✅ Immediate rotation for any exposed secrets
🔒 Test Data Protection
✅ NEVER use production data in test environments
✅ Anonymize/pseudonymize/mask all test data
✅ Securely delete test data after use
✅ Restrict test environment access (least privilege)
🚀 Phase 4: Deployment
✅ Automated CI/CD with security gates
✅ All GitHub Actions pinned to SHA commits
✅ Harden-runner enabled with egress auditing
✅ Least privilege permissions in workflows
✅ Manual approval required for production
✅ Deployment checklist completed
✅ Security metrics and monitoring configured
✅ Rollback plan documented and tested
GitHub Actions Security Pattern:
permissions:
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: step-security/harden-runner@<SHA>
with:
egress-policy: audit
- uses: actions/checkout@<SHA>
🔧 Phase 5: Maintenance & Operations
✅ Active vulnerability management per Vulnerability Management
✅ Security metrics tracked per Security Metrics
✅ Regular dependency updates (automated via Dependabot)
✅ Security patches applied per classification SLAs
✅ Incident response integration per Incident Response Plan
✅ Annual security review and threat model update
✅ Quarterly dependency and license audits
✅ Continuous monitoring and alerting
🤖 AI-Augmented Development Controls Clear Requirements for ALL AI-assisted development:
🔐 AI as Proposal Generator Only
✅ All AI outputs require human review and approval
✅ AI cannot bypass CI/CD, security gates, or approvals
✅ Human developer retains accountability for all changes
✅ AI cannot weaken security controls
✅ AI cannot autonomously deploy to production
📋 Mandatory PR Review Process
✅ All AI-assisted code goes through standard PR workflow
✅ PR description documents AI assistance used
✅ Security gates enforced (no exceptions for AI)
✅ Human reviewer verifies security controls intact
✅ Testing requirements unchanged (80%+ coverage)
🔧 Curator-Agent Governance
✅ Changes to .github/agents/*.md require CEO approval
✅ Changes to .github/copilot-mcp*.json require CEO approval
✅ Changes to .github/workflows/copilot-setup-steps.yml require CEO approval
✅ Treat as Normal Changes per Change Management
✅ Document risk assessment for capability expansion
✅ All new integrations require security review
🛡️ Security & Audit Requirements
✅ Agents operate with least-privilege tool access
✅ MCP configurations under change control
✅ All agent activities logged and auditable
✅ Capability expansion requires security review
✅ Quarterly agent ecosystem security audit
🎯 Unit Test Coverage Requirements
✅ Minimum 80% line coverage
✅ Minimum 70% branch coverage
✅ Tests run on every commit and PR
✅ UnitTestPlan.md documented in repository
✅ Public coverage reports via badges
✅ Historical coverage tracking (no regression)
✅ Coverage reports published to public URL
Reference Implementations:
🌐 End-to-End Testing Requirements
✅ All critical user journeys covered
✅ E2ETestPlan.md documented in repository
✅ Public Mochawesome/Cypress reports
✅ Cross-browser testing (Chrome, Firefox, Safari)
✅ Performance assertions within tests
✅ Authentication/authorization flows tested
✅ Error handling and edge cases covered
Reference Implementations:
🕷️ Threat Modeling Requirements
📋 Required Documentation
✅ THREAT_MODEL.md in repository root
✅ STRIDE framework application (all 6 categories)
✅ MITRE ATT&CK technique mapping
✅ Attack tree analysis with probability/impact
✅ Threat agent classification (external/internal/supply chain)
✅ Quantitative risk assessment with business impact
✅ Security control mapping with effectiveness validation
🔄 Maintenance Requirements
✅ Threat model created during design phase
✅ Updated for all architectural changes
✅ Annual comprehensive review
✅ Quarterly update cycle
✅ Incident-driven updates after security events
Reference Implementations:
🎖️ Public Evidence Requirements
Required Badges in README.md
✅ OpenSSF Scorecard (target: ≥7.0)
✅ CII Best Practices (minimum: Passing)
✅ SLSA Level 3 attestation
✅ SonarCloud Quality Gate (must be "Passed")
✅ Code Coverage badge (≥80%)
✅ License badge (OSI-approved)
✅ Threat Model link badge
Example Badge Configuration:
[](https://scorecard.dev/viewer/?uri=github.com/ORG/REPO )
[](https://bestpractices.coreinfrastructure.org/projects/ID )
[](https://sonarcloud.io/summary/new_code?id=ORG_REPO )
[](https://sonarcloud.io/summary/new_code?id=ORG_REPO )
[](https://github.com/ORG/REPO/blob/main/THREAT_MODEL.md )
📋 Master Verification Checklist Use this comprehensive checklist before ANY deployment:
Phase 1: Planning & Design ✅
Phase 2: Development ✅
Phase 3: Testing ✅
Phase 4: Deployment ✅
Phase 5: Operations ✅
AI Controls ✅
Documentation ✅
Public Evidence ✅
📚 Authoritative References
Primary Policy: Secure Development Policy Governance umbrella: Information Security Policy — sets scope, roles, risk management and accountability for everything belowRelated Policies:
Open Source Policy — licensing, SBOM, supply-chain rules (applies to every dependency added during SDLC)AI Policy — AI-assisted development, human-in-the-loop, agent-activity loggingThreat Modeling — STRIDE/MITRE ATT&CK integrated into Phase 1–2Vulnerability Management — SLAs: Critical 24h / High 7d / Medium 30d / Low 90d (drives Phase 4–5)Classification Framework — CIA triad & RTO/RPO drive required controls per phaseChange Management — Normal / Standard / Emergency change process for every deploymentIncident Response Plan — SDLC feedback loop on post-incident lessons learnedAccess Control Policy — least privilege in CI/CD, GitHub, deployment environmentsCryptography Policy — TLS 1.3, approved algorithms, key managementSecurity Metrics — KPIs (MTTD, MTTR, vuln-SLA, audit-finding closure)
Standards: STYLE_GUIDE.md
Policy Interaction Map (SDLC phase ↔ policies) SDLC Phase Primary Policies 📋 Planning & Design Info Sec · Classification · Threat Modeling · AI Policy 💻 Development Secure Dev · Open Source · AI Policy · Access Control 🧪 Testing Secure Dev · Vulnerability Management · Threat Modeling 🚀 Deployment Change Management · Access Control · Cryptography 🔧 Operations Vulnerability Management · Incident Response · Security Metrics
Framework Mapping Every SDLC control maps to ISO 27001:2022 Annex A (A.5, A.8.25–A.8.34), NIST CSF 2.0 (GOVERN, PROTECT, DETECT), CIS Controls v8.1 (IG1 #16 Application Software Security, IG2 #7 Vulnerability Management), GDPR (Art. 25 privacy-by-design), NIS2 (supply-chain & incident reporting), EU CRA (secure-by-design for software products).
💡 Key Takeaways
🛡️ Security by Design: Build security in from the start, not bolt on later
🌟 Transparency: Public evidence through badges and documentation
🏷️ Classification-Driven: All decisions aligned with project classification
🔄 Continuous Improvement: Regular reviews, updates, and learning from incidents
🤖 Human Accountability: AI assists, humans decide and approve
📊 Evidence-Based: Every security claim backed by public, verifiable proof
✅ Comprehensive Coverage: ALL 5 SDLC phases with clear, actionable requirements
