Secure Development Lifecycle

Secure Development Lifecycle Skill

Purpose

Implement secure development practices across all SDLC phases for TypeScript/Node.js MCP server development, from requirements through deployment.

When to Use

• ✅ Planning new features with security requirements
• ✅ Implementing security controls in code
• ✅ Configuring CI/CD security gates
• ✅ Conducting security reviews before release
• ✅ Managing supply chain security

SDLC Security Phases

1. Requirements

• Define security requirements alongside functional requirements
• Identify data classification (European Parliament public data, GDPR considerations)
• Determine compliance requirements (ISMS, GDPR)

2. Design

• Threat modeling using STRIDE methodology
• Security architecture documentation (SECURITY_ARCHITECTURE.md)
• Input validation strategy (Zod schemas)
• Rate limiting and API security design

3. Implementation

// Security controls in code
import { z } from 'zod';

// Input validation
const schema = z.object({
  id: z.number().int().positive(),
  query: z.string().min(1).max(500),
});

// Error handling (no information leakage)
try {
  const result = await apiCall();
} catch (error) {
  logger.error('API call failed', { error });
  throw new Error('Request failed');  // Generic message
}

4. Testing

• Unit tests with 80%+ coverage
• Security-focused tests (input validation, error handling)
• Dependency scanning (npm audit)
• License compliance (test:licenses)

5. Deployment

• Automated security checks in CI/CD
• CodeQL analysis on every PR
• SBOM generation for supply chain transparency
• Signed releases with provenance attestation

6. Monitoring

• Dependabot alerts for dependency vulnerabilities
• GitHub secret scanning
• Regular security audits

Supply Chain Security

ISMS Policy References

Core SDLC policies:

• Information Security Policy — Governance and security-by-design mandate
• Secure Development Policy — SDLC phases, DevSecOps controls, test / SBOM / SLSA obligations
• Open Source Policy — Supply-chain security, licensing, vulnerability disclosure, SBOM publication

Supporting policies:

• Change Management — Controlled, reviewed, reversible changes
• Vulnerability Management — CVSS-based SLAs (Critical 7d / High 30d / Medium 90d / Low 180d)
• Cryptography Policy — Approved algorithms, TLS 1.3+, key management
• Access Control Policy — Least privilege in CI/CD tokens and runtime
• Threat Modeling — STRIDE at design phase
• Incident Response Plan — Response to CI/CD / supply-chain incidents
• AI Policy + OWASP LLM Security Policy — AI-assisted development and MCP-specific hardening