gsd-secure-phase

An OWASP security review identifies security-touching changes across authentication, data persistence, external API calls, user input, and configuration items, verifying them against a defense-in-depth checklist before shipping.

A defense-in-depth code review gate is a process that blocks shipping until code changes pass an OWASP-aligned checklist, requiring a SECURITY.md file with a PASS status or resolved CRITICAL findings to proceed.

You enforce security checks by applying a structured review phase that identifies security-touching changes across authentication and user input, verifying them against OWASP practices before generating a required SECURITY.md gate.

Yes, the security review phase requires a SECURITY.md file to exist with Gate: PASS, or it will continue blocking until all CRITICAL findings from the OWASP-aligned checklist are fully resolved.

The OWASP security review checks code changes across authentication, data persistence, external API calls, user input, file operations, secrets, and configuration items to ensure defense-in-depth compliance.

Use an automated security review gate when shipping security-sensitive changes to verify defense-in-depth practices, ensuring vulnerabilities in data persistence or external APIs are caught before deployment via a SECURITY.md gate.