What does the secure software development process look like?
amaise follows a comprehensive Secure SDLC (Secure Software Development Lifecycle):
Threat modeling: Quarterly internal security audits with review of architecture and design patterns.
Security requirements: Documented according to OWASP Top 10 for each category.
Security-focused code review: Mandatory for every pull request. The checklist includes: no secrets in code, no PII in logs, input validation, injection prevention, XSS prevention, authorization checks, and tenant separation.
Static application security testing (SAST): On every build for all languages (Java, Python, TypeScript, Terraform).
Software composition analysis (SCA): Automatic vulnerability scanning of all dependencies on every build.
Secret scanning: Automatic detection of accidentally committed secrets on every commit.
Dynamic application security testing (DAST): Periodic external scans and annual external penetration tests.
All security gates must be passed before code can be merged. If an issue is found, the build is aborted immediately.