> For the complete documentation index, see [llms.txt](https://martian1337.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://martian1337.gitbook.io/notes/appsec/product-security-engineering.md).

# Product Security Engineering

Notes on engineering security into products and their delivery pipeline: DevSecOps and CI/CD build security, SAST and SCA tooling, product hardening, threat modeling, and product security governance.

## Related reference

These notes implement controls that the reference library in [Application and Product Security](/notes/appsec/application-and-product-security.md) defines. Read the reference for the requirement and the rationale, and the notes here for how it is built into tooling and pipelines.

| If you are working on                                                                           | Read the reference                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| ----------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SAST, SCA, and CodeQL findings                                                                  | [Vulnerability Class Reference](/notes/appsec/application-and-product-security/vulnerability-class-reference.md) for the sources, sinks, and fixes behind common findings; [Software Security Testing and Fuzzing Checklist](/notes/appsec/application-and-product-security/application-security-and-secure-sdlc/software-security-testing-and-fuzzing-checklist.md); [Secure Coding Checklist](/notes/appsec/application-and-product-security/application-security-and-secure-sdlc/secure-coding-checklist.md)                                                                                                                                                                                                                                                                                                                                                                              |
| CI/CD pipelines and DevSecOps                                                                   | [CI/CD Security](/notes/appsec/application-and-product-security/ci-cd-security.md), [Dependency Confusion and Malicious Package Defense](/notes/appsec/application-and-product-security/ci-cd-security/dependency-confusion-and-malicious-package-defense.md), [Supply Chain and Third-Party Risk](/notes/security-engineering/security-governance-risk-and-compliance/supply-chain-and-third-party-risk.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Threat modeling                                                                                 | [LLM Application Threat Modeling](/notes/appsec/product-security-engineering/threat-modeling/llm-application-threat-modeling.md) for features that embed a model; [Business Logic Flaws and Race Conditions Reference](/notes/appsec/application-and-product-security/vulnerability-class-reference/business-logic-flaws-and-race-conditions-reference.md) for misuse cases and abuse of workflows                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Product hardening and governance                                                                | [Product Security and PSIRT](/notes/appsec/application-and-product-security/product-security-and-psirt.md), [Product Security Regulation Reference](/notes/appsec/application-and-product-security/product-security-and-psirt/product-security-regulation-reference.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Shipping a multi-tenant service, serverless functions, a desktop client, or a browser extension | [Application Platform Security Reference](/notes/appsec/application-and-product-security/application-platform-security-reference.md): [Multi-Tenant Application Isolation Reference](/notes/appsec/application-and-product-security/application-platform-security-reference/multi-tenant-application-isolation-reference.md), [Serverless Application Security Reference](/notes/appsec/application-and-product-security/application-platform-security-reference/serverless-application-security-reference.md), [Electron and Desktop Application Security Reference](/notes/appsec/application-and-product-security/application-platform-security-reference/electron-and-desktop-application-security-reference.md), [Browser Extension Security Reference](/notes/appsec/application-and-product-security/application-platform-security-reference/browser-extension-security-reference.md) |
| Secure development lifecycle and program                                                        | [Application Security and Secure SDLC](/notes/appsec/application-and-product-security/application-security-and-secure-sdlc.md), [Secure SDLC Checklist](/notes/appsec/application-and-product-security/application-security-and-secure-sdlc/secure-sdlc-checklist.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |

For the hands-on testing side of the same classes, see [AppSec Testing](/notes/appsec/appsec.md).