security-kit — Contracted-Work Security Standard Kit
An in-house standard kit with a 3-layer structure to secure contracted projects. Automatically runs gitleaks/semgrep/trivy on push/PR/weekly schedule, unifying an ASVS L1 checklist with report templates.
Duration
In-house development
Team
1 person
01 // OVERVIEW
Project Overview
A GitHub template repository for reducing the cost of implementing security on contracted web app projects. It is built on Layer 0 (getting the code onto GitHub), then Layer 1 (automated push/PR/weekly checks), Layer 2 (ASVS L1 checks before delivery), and Layer 3 (records and contracts) in a 3-layer structure, keeping the extra work per project close to zero while records are kept automatically.
02 // KEY FEATURES
Key Features
Automated security checks via CI on push, PR, and weekly schedule
A GitHub Actions workflow automatically runs gitleaks (secret leak detection), semgrep (vulnerable code pattern detection), and trivy (dependency and container vulnerability scanning). All tools run within GitHub Free's limits, so it can be adopted at no additional cost.
ASVS L1 checklist and external scanning
Includes a security checklist excerpting all OWASP ASVS Level 1 items (security/asvs-l1.md) and an authorization test template. Confirms authorization gaps and misconfigurations that static analysis cannot detect, before delivery.
Records template and contract template
Includes a security implementation report template (docs/30-report-template.md) and a contract template (docs/31-contract-scope.md) that spells out scope, out-of-scope items, and liability limits. Both can be included directly in the deliverables.
03 // TECHNICAL DEEP-DIVE
Technical Highlights
Solution
Designed so new projects never start from zero
A single click of GitHub's "Use this template" button creates a private repository that carries the CI workflow over as-is. It also includes a procedure for applying the kit to existing projects (onboarding.md), guiding the move from direct server editing to Git-based management.
04 // IMPACT & RESULTS
Results
3-layer structure
Systematizes automated checks, manual review, and records
Near-zero extra effort
One template applies to every project
ASVS L1
Complies with OWASP's security standard