Find the gaps in your secure SDLC

Done when: Each requirement names the test or review that proves it, and the Definition of Done says which changes need a security review.

Done when: Abuse cases sit in the backlog with the control and the test that answer each one, or a recorded risk acceptance.

Done when: The ticket names the data classes, their retention and the obligations in scope.

Done when: Each threat has an owner and a decision: mitigate with a named control and test, accept with an expiry date, or change the design.

Done when: The design names the pattern used at each boundary, and any departure is a recorded decision.

Done when: Review findings are tracked like bugs and resolved before the affected part is built.

Done when: Each weakness class the change touches has a test that fails on the vulnerable pattern.

Done when: No secret is in the repository or its history, and a leaked one can be rotated without changing code.

Done when: New dependencies are reviewed in the pull request, and the lockfile pins every one.

Done when: Branch rules require an approving review from someone other than the author before merge.

Done when: Generated code goes through the same review and checks, and agents run with scoped permissions.

Done when: The blocking criteria are written down, findings are triaged within an agreed time, and exceptions expire.

Done when: Workflow permissions are read-only by default, and release jobs cannot be triggered from forks.

Done when: Security tests run in CI with the other tests and fail the build when a control regresses.

Done when: Confirmed findings have a reproducing test, and suppressed false positives have a recorded reason.

Done when: Fuzzing runs on a schedule, and each crash it finds becomes a test.

Done when: Every requirement in scope has evidence another engineer can repeat.

Done when: Each test has a written scope, and its findings are fixed or accepted with an owner.

Done when: The deploy step rejects unsigned artifacts and artifacts signed by an unexpected identity.

Done when: Every release has an SBOM and verifiable provenance that consumers can check.

Done when: A pre-release check of the deployed system confirms the headers, error pages and exposed paths, and a failure blocks the release.

Done when: Policy checks run on IaC and manifests in CI, and the cluster rejects workloads that break them.

Done when: Each workload can read only its own secrets, and they rotate without a code change.

Done when: Rollback has been exercised, and a bad release can be stopped before it reaches everyone.

Done when: Alerts exist for the events the threat model cares about, and the logs have been used in an exercise.

Done when: Reports and component advisories reach a named owner within days, and a security.txt file on every public host says where to report.

Done when: Each confirmed finding has an owner and a due date from a written policy, and overdue findings are visible.

Done when: Each dependency finding has a recorded decision with evidence, and known-exploited ones are fixed first.

Done when: The incident plan has a named owner and has been exercised, and advisories go out in a standard, machine-readable format.

Done when: Each significant vulnerability has a recorded root cause, and the changes it calls for are owned backlog items for the earlier phases.

Done when: Every product, finding and exception has a named owner, and each team's champion has protected time and takes part in design reviews.

Done when: Each team's training topics come from the findings it actually gets, and its repeat findings are compared before and after.

Done when: Metrics are reviewed on a set schedule, and every open exception has a risk owner and an expiry date.

Done when: Each SSDF practice or SAMM activity you claim links to current evidence, and each gap has an owner and a date.