40 - Security and Compliance Hardening (Default-Safe Engineering)¶
Home: README
Security cannot be bolted on. It must be built in from first commit.
Hardening objectives¶
- Protect credentials, tokens, and sensitive data.
- Enforce least privilege access patterns.
- Reduce dependency and supply-chain risk.
- Maintain auditable evidence of control execution.
Hardening lab pack¶
- Secrets handling baseline (env vars + secret manager model).
- Input validation and output sanitization checks.
- Dependency inventory and upgrade policy.
- AuthN/AuthZ policy checks for services.
- Audit log schema and retention policy.
- Security incident drill with documented response.
Evidence requirements¶
- Threat model for each major system.
- Security checklist in every release package.
- Audit-ready artifacts for quarterly review.