Application security · 12 answer guides
How to answer application security questions in a security questionnaire
Secure SDLC, code review, SAST and DAST, dependency scanning, and API security. These questions cover how you build and ship the product the buyer is about to rely on. Engineering-led buyers ask them, and so does every CAIQ or SIG questionnaire.
Secure development lifecycle (SDLC)
Describe your secure development lifecycle (SDLC).Code review
How do you conduct code reviews?Application security testing (SAST and DAST)
What application security testing do you perform (SAST/DAST)?Security testing in CI/CD
Is security testing automated in your CI/CD pipeline?Open source dependency management (SCA)
How do you manage open source components and dependencies (SCA)?Application vulnerability management
How do you manage application vulnerabilities?Threat modeling
How is threat modeling incorporated into your design and development process?Deployment controls
Is application deployment automated with proper controls?API security controls
Describe your API security controls.API rate limiting
Do you implement API rate limiting to prevent abuse?API key storage
How do you securely store and manage API keys?IP allowlisting
Does your application support IP allowlisting for user authentication or API access?