secure-sdlc

A team of Claude Code sub-agents that enforce security across the full SDLC, from ASVS requirements and threat modelling to SAST triage, IaC review, compliance attestation and release sign-off. Drop into any project. No security team required.

AI-Augmented Settlement Infrastructure & Governance Framework. High-Throughput (10k+ TPS) engine implementing Transactional Outbox, Event Sourcing (Marten), and strict AI Risk Management. Designed for 99.99% availability, absolute financial integrity, and PII-safe LLM integration under FINMA/DORA constraints.

Maven core extension for Java AppSec and DevSecOps build checks

Personal AppSec engineering handbook: secure SDLC, DevSecOps, threat modeling, framework mappings, architecture patterns, tooling evaluation, finding writeups.

Securing the agentic SDLC by making developer intent the first securable artifact for autonomous coding agents.

Gradle convention plugin for Java AppSec and DevSecOps build checks

A comprehensive architectural framework for integrating security into the SDLC. Featuring an interactive 12-step execution model, threat modeling methodologies (STRIDE), and DevSecOps best practices. Security is not a feature; it is the foundation

Secure CI/CD Pipeline for PCI-DSS Compliance | Demonstrates DevSecOps best practices with automated security scanning (SAST), secrets management, and Zero Trust architecture using AWS CodePipeline, Terraform, and Checkov | Multi-account AWS deployment with KMS encryption and manual approval gates | Requirements 6.2 & 6.3 compliant

Kerangka orkestrasi AI dan non-AI berbasis tata kelola dan risiko, dengan manusia dan organisasi sebagai Governance Root serta kontrol Authority, Policy, Evidence, dan Verification yang eksplisit.

Practical patterns, templates, and threat models for secure AI-assisted software delivery

SecureCycle: security across every phase of the software development lifecycle with local Semgrep scanning, policy control, taint analysis, and AI-assisted fix prompts.

Model-agnostic guardrails for AI-assisted development: design gates, Cursor rules, runtime hooks, pre-commit checks, CI security scanning, and expert-review prompts.

Python AST-based static analyzer that flags unsafe functions (eval, exec, pickle.loads) for SAST. Secure SDLC.

Cloud-focused SAST and DAST assessment of a containerized application, highlighting secure configuration, runtime risk, and remediation practices aligned with DevSecOps.

Human-initiated security review workflow: deterministic scanning, agent-assisted triage, independent adversarial validation, and an evidence gate before any finding is confirmed.

CLI-first tool to collect, normalize, evaluate and bundle Secure SDLC evidence per release.

TAAI Labs, Inc — independent third-party profile of a public API surface, by API Evangelist. TAAI Labs, Inc operates Sparkle (sparkle.security), an AI-first secure software development lifecycle (SDLC) platform, currently in beta, that aims to prevent vulnerabilities across the entire SDLC by embedding AI-powered security analysis into existing eng

Healthcare threat modeling project using STRIDE, OWASP, ISO 27001, and NIST CSF to analyze risks, trust boundaries, mitigations, and security requirements.