A.8.28 Secure Coding
Control Objective
Secure coding principles shall be applied to software development cigarettes.
Policy Statement
anDREa enforces a programmatic, checklist-driven secure coding culture to mitigate common software vulnerabilities (such as those identified in the OWASP Top 10) at the earliest stage of the development process. Writing secure code is a mandatory baseline for all engineers, ensured via automated code analyzers, peer review requirements, and strict adherence to standardized coding checklists.
Integration with Core Engineering Policies
Secure coding is not an isolated task; it is structurally integrated into anDREa’s broader development and architecture framework:
- Lifecycle Enforcement: Code construction guardrails, branch protection rules, and automated testing gates are defined and enforced under A.08.25 - Secure development life cycle.
- Architectural Blueprinting: High-level secure design principles—including containment boundaries, least privilege, and anti-user story considerations—are established in A.08.27 - Secure system architecture and engineering principles.
- Verification & Validation: Post-coding validation, dynamic security analysis, and independent auditing protocols are governed by A.08.29 - Security testing in development and acceptance.
The Developer Secure Coding Checklist
The primary mechanism for operationalizing secure coding is the Secure Coding Checklist. All developers must actively utilize and adhere to this checklist during the coding process. The checklist addresses critical software security vectors, including:
- Input Validation & Sanitization: Strict type, length, and format verification for all untrusted data entry points to prevent injection attacks.
- Authentication & Session Management: Proper cryptographic token usage, secure session timeouts, and absolute prevention of hardcoded credentials.
- Error Handling & Information Disclosure: Graceful fail-safe routines that capture system exceptions natively without leaking sensitive stack traces or infrastructure data to end-user interfaces.
- Secure Dependency Inclusion: Verifying that external software libraries, NuGet packages, or npm dependencies are obtained from trusted repositories and actively scanned for known vulnerabilities (see A.08.08 - Management of technical vulnerabilities).