Apply security threat model framework

Run security baseline checks on code and infrastructure

Continuous security validation when shipping code or IaC to production

• · code directory or infra-as-code files

• · security checklist (passed/failed)
• · CVSS scores for found issues
• · remediation steps

• · Semgrep OR Checkov
• · Trivy (for container images)

Code or IaC files accessible; scanner tool installed

• · Scanners produce false positives on compliant code
• · Custom rules not loaded if config missing

• · Supports industry standards (OWASP, CIS Benchmarks)
• · CVSS scoring included