How does this roadmap avoid disrupting developer workflows?

The skill utilizes a phased approach, starting with non-blocking foundation steps and evidence collection in Month 1 before moving to strict enforcement in the final month.

Is this roadmap specific to GitHub?

While the core principles apply generally, the specific implementation tasks and validation scripts are optimized for GitHub repositories and GitHub Actions.

What security tools does this skill help implement?

It provides implementation patterns for TruffleHog (secrets detection), Trivy/Grype (vulnerability scanning), Syft (SBOM generation), and Kyverno (policy-as-code).

Can this skill help with audit preparation?

Yes, it includes specific tasks for setting up GCS evidence archives and running audit simulation scripts to identify gaps before a real audit occurs.

SDLC Security Implementation Roadmap

Name: SDLC Security Implementation Roadmap
Author: adaptive-enforcement-lab

byadaptive-enforcement-lab

セキュリティとテスト

Guides a 90-day phased rollout of secure software development lifecycle controls and automated enforcement patterns.

概要

The Implementation Roadmap skill provides a structured, 12-week framework for hardening your development environment without disrupting existing workflows. It guides Claude through a three-month transition—starting with foundational branch protections and CI/CD checks, moving into secrets detection and SBOM generation, and concluding with policy-as-code and audit readiness. This skill is ideal for engineering teams needing to meet compliance standards or improve their security posture through prioritized, risk-based automation and evidence collection.

主な機能

12-week phased security rollout schedule with weekly tasks
Security tool integration for TruffleHog, Trivy, and Kyverno
Automated branch protection and CI/CD status check configuration
Transition guides for migrating from PATs to GitHub Apps
0 GitHub stars
Automated evidence collection workflows for audit compliance

ユースケース

Establishing a Policy-as-Code framework for Kubernetes deployments
Hardening a repository to meet SOC2 or ISO 27001 audit requirements
Migrating a team from manual security reviews to automated enforcement gates

概要

主な機能

12-week phased security rollout schedule with weekly tasks
Security tool integration for TruffleHog, Trivy, and Kyverno
Automated branch protection and CI/CD status check configuration
Transition guides for migrating from PATs to GitHub Apps
0 GitHub stars
Automated evidence collection workflows for audit compliance

ユースケース

Establishing a Policy-as-Code framework for Kubernetes deployments
Hardening a repository to meet SOC2 or ISO 27001 audit requirements
Migrating a team from manual security reviews to automated enforcement gates