Security Validation Process

A gate-driven workflow for checking code — a whole module, a service, or the changes on the current branch — against established security rulesets (OWASP Top 10, OWASP ASVS, OWASP API Security Top 10, CWE Top 25), control by control, and turning that into a traceable compliance report. The output lives in docs/security/validation/{slug}/VALIDATION.md.

This is a standards/ruleset review, distinct from snyk-remediation:

• snyk-remediation runs automated SAST/SCA scanners and fixes what they flag.
• This flow is a manual, control-by-control validation against a chosen standard — it catches design and logic issues scanners miss (broken access control, insecure business flows, missing authz checks, weak crypto choices) and maps the code to each control with a pass/fail verdict and evidence.

Run both for full coverage. This flow assesses — it does not fix by default; concrete fixes are a follow-up incu-way-development / incu-way-bugs / snyk-remediation item.