Engineering - Secure SDLC Procedure

<aside> 📌

Version: 1.0 · Effective date: 25 Sep 2026 · Review cycle: annual, or on any material change to the pipeline

Owner: @Matias Labanca · Approver: @Miguel Langone

</aside>

1. Purpose & scope

Defines how code reaches production at Horizon so that every change is reviewed, tested and security-checked before release. Applies to all production repositories (backend, frontend, infrastructure) and to everyone who contributes to them.

2. Lifecycle

Stage	What happens	Control
1. Plan	Work originates from a PRD or bug ticket and is prioritized weekly by Product.	‣
2. Build	Changes are developed on a dedicated feature/hotfix branch, never directly on protected branches.	Branch protection: no direct push or force-push
3. Verify	A Pull Request triggers CI: unit tests, SAST (Semgrep), dependency scanning (Dependabot) and secret scanning. A per-PR preview environment is deployed for QA.	Merge blocked until all required checks pass
4. Review	At least one engineer other than the author reviews code quality, tests and security impact.	≥ 1 approving review required to merge
5. Release	Changes deploy to staging for integration tests. Promotion to production requires a completed Release Plan on the PR and manual approval via GitHub Environments.	Release Plan + manual production approval
6. Operate	Runtime is monitored by GuardDuty, CloudWatch, Sentry and Dash0, with alerts routed to the 24×7 on-call rotation. Shipped changes are recorded in the Public Release Changelog.	‣ · ‣

3. Vulnerability remediation

Severity	Remediation SLA
Critical	≤ 24 hours
High	≤ 7 days

Findings come from CI scanners, AWS Inspector, the weekly automated white-box pentest and the annual external grey-box pentest (Strike).

4. Roles

Author: keeps the branch current, tests locally and documents the change in the PR.
Reviewer: approves only when quality, tests and security impact are acceptable.
Release approver: confirms the Release Plan and authorizes the production deployment.
Owner: maintains this procedure and its evidence in Vanta.

5. Frameworks this procedure supports

Framework	Status
SOC 2 Type II	Completed (Johanson LLP)
GDPR / LGPD	Ready posture
CCPA	Ready posture
NIST AI RMF	Aligned
NIST CSF	Aligned
OWASP LLM Top 10	Aligned
ISO/IEC 27001	On roadmap (gap analysis complete)
ISO/IEC 42001	On roadmap (gap analysis complete)

6. Revision history

Version	Date	Author	Approved by	Change
1.0	25 Sep 2026	Matías Labanca	Miguel Langone	Initial version.