This directory is the developer entry point for the local security workflow in this repository. It turns the controls from Milestones 1-10 into repeatable engineering steps for planning, implementation, pull requests, scanner triage, release assurance and evidence verification.
Use this index when you are unsure which check to run. The short path for most changes is make quality, make appsec-fast, make findings-full, make release-full, make lifecycle-full and make evidence-full. Use make security-assurance-full before a high-risk pull request or after changing authentication, authorisation, dependencies, Terraform, Docker, scanner policy or generated evidence.
- Secure development guide
- Getting started securely
- Local security workflow
- Pull request checklist
- Authentication
- Authorisation
- Object-level authorisation
- Secure API checklist
- Input validation
- Logging and audit
- Secrets management
- Dependency management
- SBOM
- Terraform security
- Container security
- CI/CD security
- Dynamic testing
- Vulnerability triage
- Remediation verification
- Security exceptions
- Release gates
- Secure code review
- Troubleshooting
- Glossary
- Onboarding checklist
| Category | Command | Purpose | Evidence impact |
|---|---|---|---|
| Setup | make setup |
Create the local virtual environment. | No tracked evidence. |
| Quality | make quality |
Run format, lint, type, coverage and core verifiers. | Verifies existing evidence. |
| API security | make api-security-test |
Run authentication and authorisation tests. | No tracked evidence. |
| AppSec | make appsec-fast |
Run secrets, SAST and dependency checks. | Refreshes scanner outputs. |
| AppSec | make appsec-full |
Run the full scanner and evidence aggregate. | Refreshes AppSec evidence. |
| Dynamic | make dynamic-full |
Run local-only Schemathesis, ZAP and boundary checks. | Refreshes dynamic evidence. |
| Findings | make findings-full |
Normalise and enrich scanner findings. | Refreshes findings evidence. |
| Release | make release-full |
Evaluate local release-gate evidence. | Refreshes release evidence. |
| Lifecycle | make lifecycle-full |
Evaluate vulnerability lifecycle and exceptions. | Refreshes lifecycle evidence. |
| Evidence | make evidence-full |
Build consolidated evidence across domains. | Refreshes consolidated evidence. |
| Enablement | make developer-enablement-full |
Validate guides and generate enablement evidence. | Refreshes developer enablement evidence. |
| Champions | make champions-full |
Validate the local Security Champions operating model. | Refreshes champion evidence and reports. |
| Cleanup | make clean |
Remove local caches and build artifacts. | No tracked evidence. |
Success means commands exit with code 0 and the relevant manifest verifies. Failures should be fixed in the code, configuration, scanner policy or evidence generator. Do not bypass scanners or broaden suppressions to make a pull request pass.