Development

Goal: Implement secure, privacy-aware code and configurations. 

 

 Adopt secure coding standards (OWASP, CERT) and include them in the definition of done.  

 Use automated static analysis (SAST), dependency scanning and secret detection in CI/CD pipelines. 

 Enforce strong access controls for development environments and use separate secrets management. 

 Perform regular code reviews focused on security and privacy by identifying hard-coded secrets and data exposures. 

 Implement privacy-enhancing techniques (pseudonymization, tokenization) where feasible.  

 Maintain secure build and deployment scripts; avoid embedding credentials in code.