Skip to content

Secure Development Policy

Ownership

Field Value
Policy Owner Takayuki KIKUCHI
Effective Date [Approval date]

Purpose

To ensure that information security is designed and implemented within the development lifecycle for applications and information systems.

Scope

All Rendering Consulting Inc applications and information systems that are business critical and/or process, store, or transmit Confidential data. This policy applies to all internal and external engineers and developers of Rendering Consulting Inc software and infrastructure.

General requirements

This policy describes the rules for the acquisition and development of software and systems that shall be applied to developments within the Rendering Consulting Inc organization.

System change control procedures

Changes to systems within the development lifecycle shall be controlled by the use of formal change control procedures. Change control procedures and requirements are described in the Rendering Consulting Inc Operations Security Policy.

Significant code changes must be reviewed and approved by Takayuki KIKUCHI before being merged into any production branch in accordance with the process found here: https://internal-portal.ren-con.jp/library/change-management-procedure/

Change control procedures shall ensure that development, testing and deployment of changes shall not be performed by a single individual without approval and oversight.

Development and testing activities are performed by engineers in a staging environment. All changes to production systems require a Pull Request to be created and reviewed by the CEO. Prior to merging, the CEO shall execute automated end-to-end (e2e) tests against the Preview URL and verify that the test report output is as expected. No code shall be merged to the production branch without this documented approval step.

Software version control

All Rendering Consulting Inc software is version controlled and synced between contributors (developers). Access to the central repository is restricted based on an employee's role. All code is written, tested, and saved in a local repository before being synced to the origin repository.

Technical review of applications after operating platform changes

When operating platforms are changed, business critical applications shall be reviewed and tested to ensure that there is no adverse impact on organizational operations or security.

Restrictions on changes to software packages

Modifications to third-party business application packages shall be discouraged, limited to necessary changes and all changes shall be strictly controlled.

Secure system engineering principles

Principles for engineering secure systems shall be established, documented, maintained and applied to any information system implementation efforts.

At a minimum, the following secure-by-design and privacy-by-design principles shall be applied:

Secure-by-design principles:

  1. Minimize attack surface area
  2. Establish secure defaults
  3. The principle of Least privilege
  4. The principle of defense in depth
  5. Fail securely
  6. Don't trust services
  7. Separation of duties
  8. Avoid security by obscurity
  9. Keep security simple
  10. Fix security issues correctly

Privacy-by-design principles:

  1. Proactive not Reactive; Preventative not Remedial
  2. Privacy as the Default Setting
  3. Privacy Embedded into Design
  4. Full Functionality – Positive-Sum, not Zero-Sum
  5. End-to-End Security – Full Lifecycle Protection
  6. Visibility and Transparency – Keep it Open
  7. Respect for User Privacy – Keep it User-Centric

Engineering documentation and technical references are maintained in the backend coding guide at doc/coding_guide/backend/README.md within the RenderingConsulting/VMS repository. This document covers the system architecture, authentication and authorization structure, input validation approach (Zod), output control, type safety, error handling, Prisma model design, and secure implementation practices (including environment variable handling and HTTPS requirements). Frontend coding standards are additionally maintained at doc/coding_guide/frontend/README.md.

Software developers are expected to adhere to Rendering Consulting Inc's coding standards throughout the development cycle, including standards for quality, commenting, and security.

Secure development environment

Rendering Consulting Inc shall establish and appropriately protect environments for system development and integration efforts that cover the entire system development lifecycle.

The following environments are logically and physically segregated as separate Azure resources:

  • Production: corresponds to the main branch. Built and deployed via the Main CI/CD pipeline (GitHub Actions) to a dedicated Azure Static Web Apps resource.
  • Staging: corresponds to the staging branch. Built and deployed via the Staging CI/CD pipeline (GitHub Actions) to a separate Azure Static Web Apps resource.
  • Preview: ephemeral environments automatically provisioned by Azure Static Web Apps for each Pull Request, used by the CEO for pre-production verification (see Change Management Procedure §9).
  • Development: local development environments operated by individual engineers, fully isolated from cloud-hosted environments.

Production data shall not be used in any non-production environment.

This restriction is enforced operationally, and no mechanism exists to copy production data into Staging, Preview, or Development environments.

Outsourced development

Rendering Consulting Inc shall supervise and monitor the activity of outsourced system development. Outsourced development shall adhere to all Rendering Consulting Inc standards and policies.

System security testing

Testing of security functionality shall be performed at defined periods during the development life cycle. No code shall be deployed to Rendering Consulting Inc production systems without documented, successful test results and evidence of security remediation activities.

Application vulnerability management

Application code should be scanned prior to deployment. Patches to address application vulnerabilities that materially impact security should be deployed within 90 days of discovery.

System acceptance testing

Acceptance testing programs and related criteria shall be established for new information systems, upgrades and new versions.

Prior to deploying code, a Release Checklist MUST be completed which includes a checklist of all Test Plans which show the completion of all associated tests and remediation of identified issues.

Protection of test data

Test data shall be selected carefully, protected and controlled. Confidential customer data shall be protected in accordance with all contracts and commitments. Customer data shall not be used for testing purposes without the explicit permission of the data owner and the CEO.

Acquisition of third-party systems and software

The acquisition of third-party systems and software shall be done in accordance with the requirements of the Rendering Consulting Inc Third-Party Management Policy.

Developer training

Given the single-member structure of Rendering Consulting Inc and its reliance on external contracted engineers, secure development knowledge is maintained through the following ongoing practices in place of formal annual training sessions:

  • The CEO continuously maintains current knowledge of secure development practices, common web application attacks, and emerging vulnerabilities through self-directed study, industry publications, and security advisories.
  • Relevant information regarding security threats, vulnerabilities, and recommended practices is communicated to external engineers as needed through ongoing project communications.
  • External engineers, as professional contractors, are expected to maintain current knowledge of secure development practices applicable to their role and the technologies in use.

The following threats and vulnerabilities are addressed through coding guidelines (see doc/coding_guide/backend/README.md), code review practices, and ongoing communications as appropriate:

  • Prevention of authorization bypass attacks
  • Prevention of the use of insecure session IDs
  • Prevention of Injection attacks
  • Prevention of cross-site scripting attacks
  • Prevention of cross-site request forgery attacks
  • Prevention of the use of vulnerable libraries

Exceptions

Requests for an exception to this Policy must be submitted to the CEO for approval.

Violations & enforcement

Any known violations of this policy should be reported to the CEO. Violations of this policy can result in immediate withdrawal or suspension of system and network privileges and/or disciplinary action in accordance with company procedures up to and including termination of employment.