Secure Development Practices
Overview
Secure development builds security into every stage of designing, building, testing, and maintaining software, reducing the chance vulnerabilities get introduced in the first place.
Key concepts
- Threat modeling, code review
- Patch management, dependencies
- Secrets and hardcoded secrets
How it works
Secure development is the practice of designing, building, testing, and maintaining software with security built into every stage — reducing the chance that vulnerabilities get introduced in the first place.
| Term | Meaning |
|---|---|
| Threat modeling | Identifying possible threats, attack paths, and security controls during application design. |
| Code review | Examining source code to find mistakes, quality issues, and security weaknesses. |
| Security testing | Checking an application for vulnerabilities and insecure behavior. |
| Patch management | Applying and tracking security updates. |
| Dependency | An external library, framework, package, or component used by an application. |
| Secret | Sensitive information such as passwords, API keys, encryption keys, or access tokens. |
| Hardcoded secret | Sensitive information permanently written into source code or configuration files — a common and serious mistake. |