Skip to main content

Security Validations in Code

💡 Practical note:
Tools such as SonarQube, Checkmarx, Kiuwan, Semgrep, Xygeni, Fortify and others make it possible to run security validations directly on the code, during development, in PRs or in CI/CD pipelines.
These automated validations complement human review and must be configured with mandatory minimum criteria per project.
Their effectiveness depends on integration with review practices, technical onboarding and exception control.

📌 Objectives​

  • Identify vulnerabilities in source code before delivery.
  • Automate repetitive verifications and detect trivial flaws consistently.
  • Support the review process with objective and traceable criteria.
  • Increase the team's maturity in detecting and responding to security problems.

👥 Who should apply it​

  • Developers: when writing and validating code locally.
  • Technical reviewers: when approving code and releases.
  • Security team: when defining rules, metrics and severity.

⏱️ When to apply it​

  • During development (locally or via the IDE)
  • When submitting a pull request
  • Before each release (via CI/CD)
  • In internal audits or certified deliveries

🧱 Mandatory requirements​

  1. Mandatory automated validations with SAST tools

    • Must run on each PR or commit.
    • The result must be visible and traceable.

  2. Blocking on critical or unjustified failures

    • High-severity CWE must prevent a merge without an approved exception.

  3. Integration with PR templates

    • Indicate whether validation was run, which tool was used, and whether there are pending findings.

  4. Definition of minimum criteria by severity

    • E.g. reject code with "High" findings, allow "Low" with an annotation.

  5. Traceability of fixed, accepted or justified findings

    • Findings must have a justification or a clear status (accepted, false positive, mitigated).

✅ How to validate​

  • Reports generated automatically in the CI/CD or in PRs.
  • Review checklists with reference to findings and their resolution.
  • Explicit marking in affected files or comments in the PR.
  • Links to scan evidence (e.g. Semgrep output, Kiuwan report, SonarQube dashboard).

🧾 How to evidence it​

  • Archived logs from SAST/SCA tools.
  • PR annotation with findings + resolution.
  • Per-release report with metrics on critical findings resolved vs. justified.
  • Verification scripts used in the versioned pipelines.

🔄 Link to other practices​

ThemeAssociated file
Linters and local validationsaddon/02-linters-validacoes.md
Justification of exceptionsaddon/05-excecoes-e-justificacoes.md
Traceability and evidenceaddon/09-anotacoes-evidencia.md
Team guidelinesaddon/07-guidelines-equipa.md

📌 Automated code validation is one of the pillars of technical maturity in secure development.
It must be treated as a mandatory stage of the SDLC, with clear criteria, objective evidence and integration with review processes.