skills.rest
mcj-coder
mcj-coderCOMMUNITY
Explore all skills by this author →
GitHub

security-processes

Define and enforce cross-language security processes with SCA, SBOM, SAST, and container scanning.

1|1|Updated Jan 3, 2026
Search Tags:#security#compliance#governance#vulnerability management#devsecops#policy
One-click install
npx skills add https://github.com/mcj-coder/development-skills --skill security-processes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-processes
Source: https://github.com/mcj-coder/development-skills/tree/main/skills/security-processes
Command: npx skills add https://github.com/mcj-coder/development-skills --skill security-processes

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill establishes and enforces comprehensive, organization-wide security policies and processes, ensuring consistent security posture across all languages and platforms.

Core Features & Use Cases

  • Policy Definition: Define security controls, SLAs, and exception handling for the entire organization.
  • Process Implementation: Set up baseline security pipelines including SCA, SBOM, SAST, and secret scanning.
  • Use Case: Implement a standardized security governance framework that mandates Software Composition Analysis (SCA) for all new projects, defines remediation SLAs for critical vulnerabilities, and outlines a clear process for security exception requests.

Quick Start

Use the security-processes skill to define the organization-wide security policy for all new projects.

Frequently Asked Questions about security-processes

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce organization-wide security policies across different programming languages?▼

Enforce organization-wide security policies by defining cross-language controls that orchestrate security tooling and standardize governance across the entire development lifecycle. This ensures a consistent security posture across all languages and platforms.

What security processes should be included in a standardized DevSecOps pipeline?▼

A standardized DevSecOps pipeline should include Software Composition Analysis (SCA), Software Bill of Materials (SBOM) generation, container scanning, Static Application Security Testing (SAST), and secret scanning. These baseline security pipelines ensure comprehensive vulnerability management.

How do I set up dependency update governance and vulnerability remediation SLAs?▼

Set up dependency update governance by defining security controls, establishing remediation SLAs for critical vulnerabilities, and configuring release gates. This governance framework mandates SCA for new projects and outlines clear exception handling processes.

Can I use this to manage security exception requests and policy deviations?▼

Yes, you can manage security exception requests by defining a clear process for policy deviations within the organization-wide security governance framework. This exception handling capability is built directly into the policy definition and enforcement workflow.

What is the best way to implement SAST strategy and container scanning consistently for all new projects?▼

Implement consistent SAST strategy and container scanning by establishing baseline security pipelines that mandate these processes for all new projects. This orchestrates security tooling and policy enforcement to standardize vulnerability management across teams.

Do I need to generate a Software Bill of Materials (SBOM) for every release?▼

Generating a Software Bill of Materials (SBOM) is mandated as part of the baseline security pipelines and release gates for new projects. This process ensures comprehensive software composition analysis and vulnerability tracking across the development lifecycle.

Related Skills

Explore More Software Engineering Skills→
Endor-Solutions-ArchitectureEndor-Solutions-Architecture
2

endor-cicd

Generate CI/CD security scanning configurations for GitHub Actions, GitLab CI, Jenkins, Azure DevOps, Bitbucket Pipelines, and CircleCI.

Official
Intermediate
summarybotngsummarybotng
2

QE Security Compliance

Automate security auditing, vulnerability scanning, and compliance validation against OWASP, SOC2, and GDPR.

Official
Advanced
Probably-GroupProbably-Group
3

devsecops-expert

Embed secret scanning, SAST, SCA, SBOM, and image signing into CI/CD pipelines.

Official
Advanced
duanbiao2000duanbiao2000
3

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Community
Advanced