Security scanning

Automated SAST, DAST and dependency checks.

Mandatory for 42 of 46 product types. Usually run by a security specialist.

What it catches

• known vulnerability patterns
• outdated libraries
• misconfigurations

What it misses

• business logic abuse
• novel attacks

Which product types need it and why

Done conditions used on playbook pages

Each mandatory cell has its own done condition, written for that product type.

• accounting and invoicing SaaS (Fintech): The latest scan of the web app and public API shows no open finding that exposes another company's ledger or payroll data.
• buy now pay later service (Fintech): The latest scan of the shopper app, merchant portal and checkout API shows no open finding that returns another shopper's data.
• clinical trial management software (Healthcare): The scan report for the EDC and its export endpoints shows no open high-severity finding, and a deactivated site user cannot sign in.
• crypto exchange (Fintech): Each release is scanned and no open high finding remains on withdrawal address changes, API trading keys or stored ID documents.
• data pipeline (Infrastructure and developer products): The scan of buckets, staging schemas and service accounts shows no public access and no personal fields outside approved tables.
• dating app (Consumer apps): The scan report shows no open finding on profile, photo, location and message endpoints.
• desktop application (Infrastructure and developer products): A port and process scan of a test machine after install shows no listening service beyond those in the docs, and the bundled runtime has no known critical advisory.
• e-signature service (B2B SaaS): The scan of the signing pages, document storage and API has no open high findings.
• ecommerce store (Commerce): The checkout page loads only scripts on an approved list, a change to any of them raises an alert, and the scan shows no open high-severity finding.
• email marketing platform (B2B SaaS): The scan report for the app and API has no open high finding that exposes subscriber lists or sending domain settings, and API keys are shown once at creation and masked afterwards.
• ERP system (B2B SaaS): The scan report for every internet-facing ERP portal shows no open high findings and the latest vendor security patch applied.
• expense management tool (Fintech): The latest scan of the web app, mobile API and receipt storage shows no open finding that exposes receipt images or card numbers.
• fleet and logistics tracking (Infrastructure and developer products): The scan of the dashboard, driver apps and device API shows no open high-severity finding and no hard-coded device password.
• government services portal (Public sector): The scan report for the portal and its admin tools lists no open high-severity finding, and every staff account requires phishing-resistant sign-in.
• grocery delivery app (Commerce): The scan report for the apps and API lists no open high-severity finding, and one shopper cannot read another household's address, delivery slot or doorstep notes with their own sign-in.
• identity and access management service (B2B SaaS): The scan of the admin console, token endpoints and support upload flow has no open high findings.
• insurance app (Fintech): The latest scan of the public quote tool, the agent portal and their APIs shows no open finding that exposes licence numbers or policy data.
• smart home or IoT app (Infrastructure and developer products): The scan of the app binary and device API shows no open high-severity finding and no account password or device key stored unencrypted on the phone.
• kids app (Education): The dependency report names every SDK in the build and flags none that requests location or contacts a domain outside the approved list.
• lending platform (Fintech): The latest scan of the application portal and loan API shows no open finding that exposes bank statements, SSNs or credit reports.
• LLM-based assistant (Infrastructure and developer products): The scan of the chat API and history store shows no open high-severity finding, and one account's conversation IDs return nothing from another account's session.
• loyalty program app (Commerce): The scan report for the member API has no open high findings, and membership numbers never appear in page addresses, emails or support exports.
• online marketplace (Commerce): The scan of the buyer and seller APIs shows no open high-severity finding, and payout bank-detail changes require re-authentication.
• mental health app (Healthcare): The scan report for the app and API lists no open high-severity finding on the release date, and no journal or chat text is stored unencrypted on the phone.
• messaging app (Consumer apps): The scan report shows no open finding on message, attachment and contact-sync endpoints, and the scan of each app build flags no chat data written to shared storage or left in unprotected backups.
• machine learning model service (Infrastructure and developer products): The scan of the endpoint, logs and training buckets shows no public access and no raw personal fields outside approved stores.
• mobile banking app (Fintech): Each release build is scanned and no open high finding remains on session storage, certificate checks or logged account numbers.
• neobank (Fintech): Each release build is scanned and no open high finding remains on stored ID images, tokens or card details on the device.
• peer-to-peer payment app (Fintech): Each release build is scanned and no open high finding remains on login, password reset, device binding or the endpoints that return private payments.
• patient portal (Healthcare): The scan report for the portal web app, mobile apps and API lists no open high-severity finding that exposes results, messages or proxy documents on the release date.
• pharmacy delivery app (Healthcare): The scan report for the pharmacy app, ordering site and their API shows no open high-severity finding, and a disabled staff account cannot open any prescription record.
• ride-hailing app (Commerce): The scan report for the rider and driver APIs has no open high findings before the build ships.
• software as a medical device (Healthcare): The scan report and software bill of materials for the app, firmware interface and cloud API list no open high-severity finding on the release date.
• SDK or client library (Infrastructure and developer products): The dependency report for the release lists no known-malicious or high-severity package, every transitive dependency is pinned in the lockfile, and maintainer changes are reviewed.
• social network (Consumer apps): The scan of the apps and public API shows no open high-severity finding, and profile endpoints return no private field to a non-follower.
• subscription box service (Commerce): The scan of the account and gift-redemption pages shows no open high-severity finding.
• telemedicine app (Healthcare): The scan report for the app, API and video signalling service lists no open high-severity finding on the release date.
• event ticketing platform (Commerce): The scan report for the site, apps and ticket API lists no open high-severity finding on the ticket transfer links or barcode endpoints.
• stock trading app (Fintech): The latest scan of the trading API and the support console shows no open finding that exposes account holder data.
• travel booking app (Commerce): The scan report for the apps and booking API lists no open high-severity finding on the trip lookup by booking reference or on stored passport details.
• video conferencing tool (B2B SaaS): The scan of client builds and the recording service has no open high findings, and the desktop installer leaves no local web server listening after uninstall.
• wearable companion app (Healthcare): The scan of the app binary and its sync API shows no open high-severity finding and no health data stored unencrypted on the phone.

Tools

Alphabetical. Not recommendations.