Secure Development Lifecycle

The security and reliability of our systems are paramount. Our development cycle is carefully designed with security controls built into every phase. This policy outlines the structured approach we follow to ensure every product update,
feature, or improvement is aligned with industry standards and privacy regulations.

1. Design Phase

Every new feature or system change begins in the design phase. Here, we use detailed checklists to assess the security implications before any development work begins. These checklists ensure our designs meet the following
principles:

  • Least privilege: We only grant the minimum permissions required.
  • Defense in depth: Multiple layers of security are considered.
  • Secure by design: Security is an integral part of the functionality.
  • Feel secure by default: Features work securely out of the box.
  • Encryption: Data must be encrypted in transit and at rest.
  • Monitoring and Logging: We verify logging is implemented securely, without exposing PII.
  • PII Assessment: We assess whether personal data is involved and ensure any processing of new PII is documented. If applicable, updates are made on our public-facing privacy portals.

2. Development in Scrum

Development takes place in structured sprints led by our Scrum Master and coordinated with the Product Owner. Features are built and tracked in sprint planning sessions.

Once development is complete (or partially complete), the developer submits a Pull Request (PR) via our secured GitHub Enterprise environment.

3. Secure Code Review

All PRs must go through a mandatory review process. Code cannot be merged into the main branch without meeting these security standards:

  • Manual code review by team members.
  • Automated scans via GitHub Enterprise Copilot and CodeQL.

  • Security checklist validation, including:

    • Re-confirming any PII usage and documenting it.
    • Validating that no more data is processed than absolutely necessary.
    • Verifying that secrets and API keys are securely managed.
    • Ensuring access controls are implemented correctly.
    • Testing for SQL and XSS injection risks.
    • Confirming that no PII is leaked in logs.
    • Validating rate-limiting and abuse protection.
    • Reviewing the deployment strategy and ensuring a rollback plan exists.

The checklist is aligned with the OWASP Top 10 to cover the most critical web application security risks.

4. Testing Phase

After approval and merge, the feature is deployed to our staging environment, which mirrors production. Extensive testing is performed to ensure stability, functionality, and security.

5. Release Process

When ready, the release undergoes an additional review phase before it is rolled out to production. This includes:

  • Checking code quality again.
  • Verifying database integration integrity.
  • Scanning all dependencies for vulnerabilities.
  • Ensuring the production environment is prepared.
  • Assessing whether the release will result in zero downtime.

Important: Any release requiring downtime must be planned at least one month in advance (unless urgent), and customers are notified accordingly through status.x-guard.nl.

The default policy is to aim for zero downtime in 99% of releases.

We also revalidate rollback plans, assess system health, and ensure CodeQL has not identified any issues. Only after passing these criteria is the version incremented and the release approved.

6. Release Timing Policy

X-Guard enforces strict rules for when releases may occur:

  • No releases on Thursdays, Fridays, weekends, or outside office hours.
  • Only during office hours, so the full IT and DevOps teams are available.

This policy exists because our systems are used in emergency and safety-critical contexts, which also apply outside normal business hours. There is no universally convenient “off-peak” time for our users.

Therefore, in the interest of operational safety, we have chosen to deploy updates only during working hours, when the full team is present to respond immediately if needed. We are always able to deviate from this policy for urgent deployments.

Our Secure Development Lifecycle reflects our commitment to transparency, safety, and reliability. By integrating privacy and security checks at every stage — from design to production — we protect our users and meet the high standards expected from a mission-critical platform like X-Guard.