Secure Software Development Lifecycle (SDLC) Policy¶
| Field | Value |
|---|---|
| Owner | Puneet Gupta (Co-Founder) |
| Classification | Internal (shareable under NDA) |
| Version | 1.0 |
| Effective date | 2026-06-11 |
| Next review | 2027-06-11 |
1. Purpose¶
Ensure security is embedded throughout the development of the Pixis platform.
2. Secure development practices¶
- Version control & review — all changes go through Git with mandatory peer review before merge.
- Pre-commit checks — automated checks run before commits are accepted.
- Environment separation — development and production are isolated.
- Secrets management — secrets are kept out of source control; integration credentials are encrypted (AES-256-GCM).
- Least-privilege data access — enforced in code via tenant-scoped Row-Level Security.
- Database changes — applied through reviewed, versioned migrations.
3. Open-source components¶
The platform uses open-source libraries (web/API frameworks and their dependencies). Dependencies are declared in package manifests and kept current. Automated Software Composition Analysis (SCA) for continuous vulnerability detection and remediation tracking is being introduced. (Planned.)
4. Application security testing¶
Automated SAST/DAST/IAST is being introduced; until then, security is addressed through mandatory peer review, pre-commit checks, and dependency hygiene. (Planned.)
5. API security¶
Application APIs are authenticated with JWT bearer tokens over TLS. Where programmatic integrations are added, supported controls include dynamic tokens, API keys with IP allowlisting, and field-level encryption of PII in addition to TLS.
Revision history¶
| Version | Date | Author | Change | Approved by |
|---|---|---|---|---|
| 1.0 | 2026-06-11 | Puneet Gupta | Initial draft | Puneet Gupta (Co-Founder) |