Section 09, the plan, page 12
A 30-day starter plan
One month, four moves, no budget. Each week builds on the last and leaves you measurably safer than the week before.
Week 1 Get Visibility
• Turn on Dependabot (or Renovate) and your platform's code scanning in one key repo.
• Add Gitleaks as a pre-commit hook so no new secret can be committed.
• Generate one SBOM with Syft. You cannot protect what you cannot see.
Week 2 Build A Baseline
• Add Semgrep to CI with the default ruleset; triage, don't drown.
• Run Trivy against your dependencies and container images; fix the criticals.
• Write down a starting MTTR target for high-severity findings.
Week 3 Probe The Running App
• Run an OWASP ZAP baseline scan against a staging environment.
• Fix the top issues and re-scan to confirm they are actually closed.
• If you ship an LLM feature, test it against the OWASP LLM Top 10.
Week 4 Make It Stick
• Move secrets out of config and into a vault (Vault or Infisical).
• Reserve a standing security-debt budget in every cycle.
• Add "passes security checks" to your team's definition of done.
