NIST SSDF Phase 4 — Test

Phase label: nist-phase-4-test

This skill files GitHub issues. It does not write code.

What this phase is about

Test is where we look for what slipped past the design and build controls. Two complementary practices live here: PW.7 covers everything that examines the code itself (peer review, static analysis), and PW.8 covers everything that exercises the running executable (dynamic analysis, fuzzing, penetration testing). Both feed discovered issues into the same workflow and issue tracker, so triage and remediation are tracked alongside other engineering work.

Practices

Walk these in order — each one assumes the previous has landed. Read a practice's reference file only when you reach it, not up front.

How to run

Follow the phase walkthrough protocol in references/protocol.md. Substitutions:

• <PHASE_N> = 4
• <PHASE_NAME> = Test
• <PHASE_LABEL> = nist-phase-4-test
• <PRACTICES> = PW.7, PW.8

Phase epic title: [NIST Phase 4] Test.

The protocol confirms scope with the user, finds or creates the phase epic, then walks each practice — checking for an existing epic, asking whether to file, link, or skip, and updating the phase epic checklist as it goes. It never creates an issue without confirmation.

Adapting to the repo

The implementation notes in each reference file are deliberately generic, because this skill is meant to run against any repository. Before drafting an epic, look at what testing the repo already does — the CI workflow, the test suite, any existing scanning — and rewrite the notes around the real gaps. "There is no dynamic analysis against a running instance before release" is worth more than "consider DAST".

Both practices end the same way: findings become tracked issues with a severity and a remediation deadline. If the repo has no triage path for a security finding, that gap matters more than which scanner gets wired up first.