Build a security program your team can operate.
Practical plans, implementation checklists, and evaluation rubrics for security leaders and the engineers who work with them.
From the first plan to the next release.
Each guide includes concrete artifacts, review criteria, and steps you can adapt to your own applications.
Add CodeQL security checks to GitHub Actions
A practical GitHub Actions tutorial: add a minimal CodeQL workflow, verify scan coverage, and review alerts before enforcing a pull request gate.
ExploreReview SARIF findings without losing context
Inspect a SARIF security report locally, distinguish severity from confidence, compare scan runs, and record decisions that an engineer can act on.
ExploreVerify a security fix with a regression test
A defensive tutorial for reviewing security patches: state the invariant, add a harmless regression test, preserve valid behavior, and record verification boundaries.
ExploreA 90-day application security program checklist
Build an AppSec program with a 90-day plan for coverage, ownership, triage, remediation, and evidence your leadership team can use.
ExploreA practical CI/CD security checklist for pull requests
Roll out defensive pull request security checks with a clear gate policy, protected CI permissions, exceptions, and measurable feedback.
ExploreHow to evaluate an enterprise security tool
Compare AppSec vendors using a practical pilot rubric for evidence, workflow, deployment, data handling, coverage, and total operating cost.
Explore