Secure Development

Core Platform helps teams build, test, scan, promote, and deploy software through a secure delivery path from the first pull request to production.

Secure development is built into the way Core Platform works. Applications deployed through Core Platform use Path to Production to make delivery controlled, repeatable, and auditable. The same workflow gives teams security feedback on source code, dependencies, container images, and secrets before changes reach production.

Core Platform supports secure development by making the secure path the normal path:

• Changes are made through version-controlled repositories.
• Pull requests provide review, approval, and traceability.
• Path to Production runs automated validation before promotion.
• Source dependencies and built images are scanned for vulnerabilities.
• Source code and built images are scanned for secrets.
• Production releases are connected back to source changes, workflow runs, test results, approvals, and deployed versions.
• Infrastructure can be provisioned through OpenTofu and delivered through the same controlled workflow instead of manual console changes.

Secure Development With Core Platform

Core Platform enables secure development through Path to Production, the standard workflow for building, validating, promoting, and deploying applications and infrastructure.

For applications, Path to Production provides:

• Fast Feedback on pull requests and pushes.
• Automated build and test stages.
• Source dependency vulnerability scanning using Trivy.
• Image operating system and package vulnerability scanning using Trivy.
• Source secret scanning using TruffleHog.
• Image secret scanning using TruffleHog.
• Extended Test and Production gates before release.
• Workflow summaries, artifacts, PR comments, and deployment records for evidence.

For infrastructure, Core Platform supports OpenTofu-based delivery so teams can define infrastructure changes as code, review them before merge, and apply them through controlled workflows. This keeps databases, cloud services, IAM, networking, and platform configuration traceable and repeatable.

Secure Engineering Principles

Core Platform gives teams a secure delivery foundation, but secure development also depends on how systems are designed and maintained.

Teams should apply secure-by-design principles:

• Minimize attack surface area.
• Establish secure defaults.
• Apply least privilege.
• Use defense in depth.
• Fail securely.
• Do not blindly trust services.
• Maintain separation of duties.
• Avoid security by obscurity.
• Keep security simple.
• Fix security issues correctly.

Teams should also apply privacy-by-design principles:

• Be proactive, not reactive.
• Make privacy the default setting.
• Embed privacy into design.
• Preserve full functionality; positive-sum, not zero-sum.
• Protect data across its full lifecycle.
• Maintain visibility and transparency.
• Respect user privacy.

Secure Development Evidence

Because secure delivery happens through Core Platform workflows, evidence is created as teams work.

Useful evidence includes:

• Pull requests showing requested changes, reviewers, approvals, and merge decisions.
• Branch protection and CODEOWNERS configuration.
• P2P workflow runs showing build, test, scan, promotion, and deployment results.
• Security scan summaries and uploaded artifacts.
• PR comments showing active vulnerability and secret findings where enabled.
• OpenTofu plans, reviews, applies, and workflow history for infrastructure changes.
• Release and deployment history showing which version was promoted to each stage.
• Accepted finding records in .p2p-security-ignore.yaml.
• Scheduled security scan runs for already deployed images and current source dependencies.
• Application dashboard delivery status showing version progression through Path to Production.

Shared Responsibilities

Core Platform provides the secure delivery foundation:

• Path to Production for application and infrastructure delivery.
• Built-in vulnerability and secret scanning.
• Promotion gates before production deployment.
• OpenTofu-based infrastructure delivery patterns.
• Workflow artifacts and summaries for audit evidence.
• Documentation for scan configuration, scheduled scans, and accepted findings.

Teams remain responsible for how they use that foundation:

• Keep production branches protected.
• Require peer review and passing checks before merge.
• Maintain CODEOWNERS or equivalent ownership rules.
• Review and remediate vulnerability and secret findings.
• Configure blocking severity to match risk tolerance.
• Use infrastructure as code for production infrastructure.
• Avoid manual console changes except through approved exception processes.
• Protect test data and avoid using confidential customer data without approval.
• Ensure engineers follow secure coding standards and receive appropriate training.