Lesson 5.3: Capstone: a security release gate
Everything in this course becomes a checklist that runs before every release, so the fixes stay fixed. In the lab you review the release bundle of shop 2026.11 the way a release gate does: token validation and OAuth clients, the rate limit and the enforced CSP, Subresource Integrity on the checkout page with one documented exception, and the dependency audit. Then you write a short gate decision with follow-ups and seal it.
20 min
You will learn to
- Turn fixes into release checks
- Check auth configuration automatically
- Check edge and browser controls
- Check dependencies
- Write and seal a gate decision
Key terms
- Release gate
- Automated and manual checks that must pass before a release ships.
- Regression
- A fixed problem that comes back in a later change.
- Policy as code
- Security rules written as checks a pipeline runs, instead of documents.
- Documented exception
- A known deviation with justification, compensating controls and an owner.
- OWASP ASVS
- Application Security Verification Standard: a catalogue of requirements to test web applications against.
← SQL injection · All lessons · LAPS: a different local admin password on every machine →