> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/company-operating-manual/engineering-and-technical-standards/secure-development.md).

# Secure Development

### Purpose

Secure development ensures that security is built into delivery rather than added at the end.

### Secure Development Practices

Teams should use:

* secure coding practices
* code review
* dependency scanning
* secrets management
* least privilege access
* secure configuration
* logging and monitoring
* vulnerability management
* threat modelling where appropriate
* security testing before release

### Security Evidence

Projects should retain:

* security requirements
* threat model
* access control record
* vulnerability scan results
* penetration test results where applicable
* remediation records
* risk acceptance records