Draft for review. Statuses and facts are being verified before publication.
KuraplanTrust Center
Controls

Product security

Secure development lifecycle

In progressCriticalVerified 15 September 2026ST4S Q3, Q5, Q8

What this control means

Every change goes branch, pull request, automated checks, preview deployment, review, then production. Threat modelling covers the AI pipeline.

What we found

The main branch of the app and website now accepts changes only through pull requests; force-pushes and deletion are blocked. Automated checks on every pull request are next.

How we verified it

  1. Checked repository settings via the GitHub API: no branch-protection rule existed on main.
  2. Upgraded the GitHub organisation so rules can be enforced on private repositories.
  3. Added an active ruleset on main for the app and website repositories: pull request required, no force-push, no deletion. Verified via the rules API.
  4. Confirmed lockfiles and per-branch preview deployments are in place.

Still to do

  • Add a continuous-integration workflow that runs type checks and tests on every pull request, then require it to pass.
  • Publish the secure development lifecycle document naming OWASP ASVS Level 1.

Evidence (private, draft only): kuraplan-st4s-evidence/04-product/2026-09-15-sdlc-and-dependency-findings.md

Questions about this control: security@kuraplan.com