Security touchpoints at every phase—from backlog to production telemetry.
Each phase can emit evidence for compliance and quality gates. Amber border highlights phases with common automated security checks.
Scroll horizontally on small screens to view all phases.
Static analysis on source or bytecode before execution. Catches injection patterns, weak crypto usage, and dangerous APIs early in CI.
Examples: Semgrep, SonarQube, Checkmarx, Fortify.
Black-box testing against a deployed environment. Finds misconfigurations, exposed admin panels, and runtime-only flaws.
Examples: OWASP ZAP, Burp Suite, stack-specific scanners.
Inventory third-party libraries and match against CVE/GHSA databases. Often combined with license policy.
Examples: Snyk, Mend, OWASP Dependency-Check, OSV.
Goal-oriented adversary simulation beyond tool signatures. Validates chains of vulnerabilities and detective controls.
Fit: Pre-release, major changes, or regulated cadence.
| Phase | Typical gates | Artifact |
|---|---|---|
| Plan | Threat model sign-off | Diagram + risk register |
| Code | No secrets in diff | Hook logs |
| Build | SAST/SCA thresholds | SARIF, SBOM |
| Test | DAST baseline diff | Scan report, tickets |
| Release | Change record, approvals | Release notes, vuln exceptions |
| Deploy | IaC policy pass | Plan files, attestations |
| Monitor | Detection coverage | Alerts, MTTR metrics |