Practice

Controls

1. 01

   Model the threat

   Before code: list the assets, the people who want them and every place data crosses a process, a network or a vendor.

2. 02

   Keep secrets home

   Keys live in Key Vault, the OS keychain or the platform secret store, never in the bundle, the repo or a client request.

3. 03

   Scan every push

   SAST with Bandit, Semgrep and Trivy on each commit, DAST with OWASP ZAP before a release, the same gates that passed a CASA Tier 2 preparation.

4. 04

   Mask what leaves

   Personal details are replaced before text reaches a third-party model, and restored only on the machine that owns them.

5. 05

   Ask before acting

   Anything that sends, deletes or runs waits for a human yes, with the details on one card and an expiry.

6. 06

   Watch and account

   Traces, metrics and cost per request in one place, so a slow endpoint or a 4.2 TB surprise shows up as a number, not an invoice.