SDLC & SBOM Policy

1. Purpose

This document describes XBert’s software development lifecycle, including secure development practices, testing standards, release management, and software supply chain transparency via a Software Bill of Materials (SBOM).

2. Scope

This policy covers all software developed, maintained, and deployed by XBert, including:

xbert-app-ui - Angular frontend application
xbert-app-server - C# ASP.NET Core backend API
xbert-app-processing - Background processing and AI services
xbert-fabric - Azure Functions data processing layer
xbert-capture - Mobile and web client communication app
XBert.Mcp.Server - MCP server for AI tool integrations
mem0-service - AI memory service (Python)

3. Development Methodology

XBert uses an Agile development methodology with:

Weekly sprints for feature development
Daily stand-ups for progress review and issue triage
Sprint planning for prioritisation of features, bugs, and security items
Security and performance items are evaluated at the daily stand-up level and can be prioritised independently of the feature release process

4. SDLC Phases

4.1 Requirements and Design

Activity	Description
Requirements gathering	Features defined in GitHub Issues with acceptance criteria
Security considerations	Threat modelling for features handling sensitive data or new integrations
Architecture review	Technical design reviewed by senior engineers before implementation
Privacy impact	Features processing personal data assessed against Australian Privacy Principles

4.2 Development

Practice	Implementation
Source control	Git (GitHub Enterprise, private repositories)
Branching strategy	Feature branches with PR to main; release branches for deployment
Code ownership	All source code owned and maintained solely by XBert Pty Ltd
Coding standards	C#: PascalCase public, _camelCase private; Angular: Angular style guide; Australian English spelling
Secure coding	OWASP Top 10 awareness; input validation; parameterised queries; output encoding
Secrets management	No secrets in source code; all secrets in Azure Key Vault
Developer environment	All development located within Australia by XBert employees under NSW law contracts

4.3 Code Review

Requirement	Details
Peer review	All changes require at least one peer review via GitHub Pull Request
Branch protection	Main branch protected; direct pushes prohibited
Review checklist	Functionality, security, performance, test coverage
Automated checks	CI pipeline must pass before merge (build, lint, tests, security scans)

4.4 Testing

Test Type	Scope	Automation
Unit tests	Individual functions and services	Automated in CI pipeline
Integration tests	API endpoints and service interactions	Automated in CI pipeline
Security scanning	Static code analysis, dependency vulnerabilities	Automated in CI pipeline (OWASP tools, Dependabot)
Penetration testing	Full application security assessment	Annual (external provider)
Regression testing	End-to-end feature validation	Automated (Playwright) + manual

4.5 Build and Release

Stage	Environment	Purpose	Deployment Method
Build	CI pipeline	Compile, test, scan	Automated (Azure DevOps)
Development	Dev environment	Developer integration testing	Automated deployment on PR merge
Staging	Staging environment	Pre-production validation	Automated deployment; manual approval gate
Production	Production environment	Live customer-facing	Automated deployment via slot swap (zero-downtime)

Key release management practices:

CI/CD pipeline: Azure DevOps with automated build, test, and deployment
Deployment slots: Azure App Service slots for zero-downtime deployments
Rollback: Immediate rollback capability via slot swap
Feature flags: Used for gradual rollout of significant features
No manual deployments: All production changes flow through the CI/CD pipeline
Audit trail: All deployments are logged and auditable in Azure DevOps

4.6 Post-Release

Activity	Frequency	Tool
Production monitoring	Continuous	Azure Monitor, Application Insights, Sentry
Error tracking	Continuous	Sentry
Uptime monitoring	Continuous	Pingdom
Performance monitoring	Continuous	Application Insights
Customer feedback	Ongoing	Intercom
Security patching	Per Patch Management Policy	GitHub Dependabot, Defender for Cloud

5. Security in the SDLC

5.1 Secure Development Practices

Practice	Description
Input validation	All user input validated at API boundaries
Parameterised queries	Entity Framework ORM prevents SQL injection
Output encoding	Angular’s built-in XSS protection; server-side encoding
Authentication	OAuth 2.0 via Auth0; JWT token validation
Authorisation	Role-based access control; tenant isolation
Error handling	Structured error responses; no sensitive data in error messages
Logging	Security events logged; no secrets or PII in logs
Dependency management	Automated vulnerability scanning; pinned versions

5.2 CI/CD Pipeline Security Controls

Code Commit
    |
    v
[GitHub Branch Protection] -- PR required, review required
    |
    v
[Automated Build] -- Compile, restore dependencies
    |
    v
[Security Scanning] -- OWASP tools, dependency vulnerability check
    |                    npm audit, dotnet list package --vulnerable
    v
[Automated Tests] -- Unit tests, integration tests
    |
    v
[Code Review] -- Peer review approval required
    |
    v
[Merge to Main] -- Protected branch merge
    |
    v
[Staging Deployment] -- Automated; manual validation gate
    |
    v
[Production Deployment] -- Slot swap (zero-downtime)
    |
    v
[Post-Deploy Monitoring] -- Sentry, Application Insights, Pingdom

6. Software Bill of Materials (SBOM)

6.1 Overview

XBert maintains visibility into its software supply chain through dependency management tools and automated scanning. The SBOM covers all third-party libraries, frameworks, and runtime dependencies used across XBert applications.

6.2 SBOM Generation

Repository	Package Manager	SBOM Source	Format
xbert-app-ui	npm	package-lock.json	npm lockfile v3
xbert-app-server	NuGet	packages.lock.json / .csproj	NuGet package references
xbert-app-processing	NuGet	packages.lock.json / .csproj	NuGet package references
xbert-fabric	NuGet	packages.lock.json / .csproj	NuGet package references
xbert-capture	npm	package-lock.json	npm lockfile v3 (Expo/React Native)
mem0-service	pip	requirements.txt	pip freeze

6.3 Key Frameworks and Runtimes

Component	Framework	Version (Current)
Frontend (main)	Angular	See xbert-app-ui package.json
MCP Gateway	ASP.NET Core (.NET)	See xbert-mcp-gateway .csproj
Backend API	ASP.NET Core (.NET)	See xbert-app-server .csproj
Background processing	ASP.NET Core (.NET)	See xbert-app-processing .csproj
Data processing	Azure Functions (.NET)	See xbert-fabric .csproj
Mobile app	React Native (Expo)	See xbert-capture package.json
AI memory service	Python + Mem0	See mem0-service requirements.txt
AI agents	Microsoft Agent Framework	See xbert-app-processing .csproj

6.4 SBOM Availability and Format

SBOM data is generated from lock files and package manifests as part of the CI/CD build process
SBOMs are maintained in native package manager formats (npm lockfile v3, NuGet package references, pip requirements)
Standardised SBOM exports (CycloneDX JSON) can be generated on request for enterprise customers — contact security@xbert.io
SBOMs are updated with every production deployment, ensuring they reflect the current dependency state
New dependencies require review and approval by a senior engineer for security posture, maintenance status, and licence compatibility before inclusion

6.5 Supply Chain Security

Control	Implementation
Dependency pinning	Lock files committed to source control; no floating versions
Vulnerability scanning	GitHub Dependabot (continuous), npm audit, dotnet vulnerable package check
Licence compliance	Reviewed during dependency addition; no copyleft licences in distributed code
Private registry	NuGet and npm packages sourced from official public registries
Code signing	GitHub verified commits encouraged
Dependency review	New dependencies reviewed for maintenance status, security posture, and licence

7. Roles and Responsibilities

Role	Responsibility
CTO	Policy owner; approves SDLC process changes; oversees security practices
Development Manager	Manages release process; enforces code review and testing standards
Developers	Follow secure coding practices; write tests; review peer code; maintain dependencies
QA	Execute regression and exploratory testing; maintain automated test suites

8. Compliance

This policy supports compliance with:

ISO 27001 Annex A.14 (system acquisition, development and maintenance)
OWASP Secure Development Guidelines
Essential Eight - Application patching, application control
Privacy Act 1988 (Cth) - secure handling of personal information in development

9. Change History

Version	Date	Changes
1.0	April 2026	Initial creation