skills.rest
s3nex-com
s3nex-comCOMMUNITY
Explore all skills by this author →
GitHub

security-audit-secure-sdlc

Codify STRIDE threat modeling and security gates across the SDLC.

Updated Apr 8, 2026
Search Tags:#security#audit#compliance#gates#sdlc#threat-modelling
One-click install
npx skills add https://github.com/s3nex-com/sdlc-skills-library --skill security-audit-secure-sdlc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit-secure-sdlc
Source: https://github.com/s3nex-com/sdlc-skills-library/tree/main/skills/phase1/security-audit-secure-sdlc
Command: npx skills add https://github.com/s3nex-com/sdlc-skills-library --skill security-audit-secure-sdlc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Streamlines security governance across the software development lifecycle by codifying threat modelling, governance gates, and audit-ready outputs.

Core Features & Use Cases

  • Threat modelling at design time (Gate 1) with STRIDE threat inventory, risk scoring, and residual risk acceptance.
  • PR-time gate checks (Gate 2) including secret scanning, SAST, and contract-driven security reviews.
  • Pre-deployment checks (Gate 3) covering SCA, SBOM, container image signing, and IaC security.
  • Production readiness gate (Gate 4) with pentest requirements, runbooks, and governance documentation.
  • Centralized artifacts: threat model, gate results, and security findings reports for compliance and audits.

Quick Start

Initiate Gate 1 threat modelling for a new service, attach the threat inventory to the architecture document, and trigger Gate 2 checks in the PR.

Frequently Asked Questions about security-audit-secure-sdlc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate threat modelling and security gates across the SDLC?▼

Automate SDLC security governance by codifying STRIDE threat modelling and governance gates to produce audit-ready security findings. It applies gate-based reviews across design-time, PR-time, pre-deploy, and production readiness scenarios.

What is STRIDE threat modelling and when do I need it for software compliance?▼

STRIDE threat modelling inventories threats and scores risk during design time. You need it for software compliance to ensure residual risk acceptance is documented before proceeding to PR-time gate checks.

How do I embed SAST and secret scanning into pull request security reviews?▼

Embed SAST and secret scanning into PR-time gate checks to enforce secure coding standards. Gate 2 triggers contract-driven security reviews automatically within the pull request workflow to block insecure code.

Can I generate SBOM and check IaC security during pre-deployment?▼

You can generate SBOM and check IaC security during pre-deployment using Gate 3. This pre-deployment gate also covers SCA and container image signing to ensure production readiness before release.

What's the best way to prepare for production readiness security audits?▼

Prepare for production readiness audits by triggering Gate 4 to verify pentest requirements and runbooks. This generates centralized governance documentation and security findings reports for compliance.

Related Skills

Explore More Software Engineering Skills→
ArogyaReddyArogyaReddy

stride-analysis-patterns

Identify and document threats in systems using STRIDE methodology.

Community
Advanced
ZateZate
9

audit-report

Generate structured security audit reports with findings, severity, and ASVS mappings.

Community
Advanced
arbazkhan971arbazkhan971
26

devsecops

Integrate security scanning into CI/CD pipelines with blocking gates.

Community
Advanced
protofireprotofire
3

protofire-vciso-agent

Automate GRC lifecycle governance and security gate verification for protocol engagements.

Official
Advanced