Avoid using sensitive production data in test environments
Avoid leaking sensitive data in source control
Adopt the two-person rule
Treat security tests like functional tests
Builds should be isolated from each other
Security analysis on every build
Ensure availability and consistency of artefacts
Ensure provenance of first-party artefacts
Establish provenance of third-party components
Automate pipeline progression based on policy