决策地图
安全：把控制点放在真实威胁边界上
覆盖密钥、访问控制、应用保护与合规准备，避免把安全当成勾选清单。
Recommendation
从身份、密钥管理和应用边界的最小控制开始，按客户与法规要求加深。
先识别数据、身份和部署边界，再选择能被团队持续运营的控制。
范围
用这条边界避免在错误层级解决相邻问题。
包含
- Secret lifecycle and credential controls
- Automated-abuse detection and mitigation
- Request quotas and rate enforcement
- HTTP-layer request filtering
- Security audit trails and log-management requirements
- Real-world identity proofing and verification
- Security-control evidence and assurance workflow automation
- Vulnerability scanning across dependencies, source, containers, and infrastructure as code
不包含
- Application authentication and authorization, which belong to Identity
- Payment transaction fraud, which belongs to Payments
- General diagnostics, performance telemetry, and operational logging
- Legal advice, privacy counsel, non-security compliance, certification promises, or guaranteed audit outcomes
- Penetration testing and complete secure-development programs as synonyms for vulnerability scanning
重要工具
这些工具代表此决策领域内不同路线；请先打开相关任务页面，再将任何工具视作默认。
- Vercel
- Doppler （英文页面）
- Infisical （英文页面）
- AWS Secrets Manager （英文页面）
- HashiCorp Vault （英文页面）
- Cloudflare Turnstile （英文页面）
- hCaptcha Enterprise （英文页面）
- Google reCAPTCHA （英文页面）
- Arkose Bot Manager （英文页面）
- Upstash Ratelimit （英文页面）
- Cloudflare Rate Limiting （英文页面）
- Kong Gateway （英文页面）
- Envoy （英文页面）
- Cloudflare WAF （英文页面）
- AWS WAF （英文页面）
- Fastly Next-Gen WAF （英文页面）
- WorkOS Audit Logs （英文页面）
- Axiom （英文页面）
- Datadog （英文页面）
- Persona （英文页面）
- Stripe Identity （英文页面）
- Veriff （英文页面）
- Vanta （英文页面）
- Drata （英文页面）
- Secureframe （英文页面）
- Snyk （英文页面）
- GitHub Dependabot （英文页面）
- Semgrep （英文页面）
- Trivy （英文页面）
决策顺序
先完成基础归属判断，再增加专门能力。
Is the immediate problem automated behavior, request volume, malicious HTTP patterns, credential exposure, proofing, evidence, or vulnerable artifacts?
Begin from the protected asset, threat, or assurance obligation rather than a generic security-platform search.
Bot Protection Rate Limiting Web Application Firewalls Secrets Management Identity Verification Audit Logs Compliance Automation Vulnerability Scanning
Which sensitive credentials require creation, storage, distribution, rotation, revocation, expiration, and audit controls?
Define the entire secret lifecycle and runtime or CI ownership before choosing a storage product.
Does the request-defense problem concern automated actors, quota, or HTTP payload and rule matching?
Use Bot Protection for automated abuse, Rate Limiting for quotas, and Web Application Firewalls for HTTP-layer rule enforcement; layer controls only when the threat model requires it.
Which security or administrative actions must be attributable, retained, protected, exported, and reviewed?
Define audit-event and log-management requirements before selecting storage or analytics.
Does the product need confidence in real-world identity evidence beyond ordinary account authentication?
Choose the proofing level, evidence, geography, privacy, failure, and exception path separately from login.
Which artifact requires vulnerability detection: dependency, source code, container, or infrastructure as code?
Keep one Vulnerability Scanning Task but select explicit SCA, SAST, container, and IaC routes; do not assume one engine covers all surfaces.
Is there a named security framework or customer assurance obligation with defined controls and evidence?
Only then evaluate Compliance Automation for control mapping, evidence exchange, assessment, and findings; do not treat it as legal advice or automatic certification.
决策分组
每个任务都对应一个独立的用户决策，而非产品功能标签。
Credential controls
Protect sensitive credentials through their full lifecycle rather than treating secret storage as generic configuration.
Request defense
Separate automated-actor detection, quota enforcement, and HTTP request filtering before deciding whether to layer them.
Evidence, proofing, and assurance
Treat attributable audit evidence, real-world identity proofing, and control-assessment automation as related but distinct assurance jobs.
Vulnerability discovery
Route one scanning intent across SCA, SAST, container, and IaC surfaces while preserving a shared triage and remediation workflow.
常见混淆
这些边界避免相邻任务被压缩成一个泛泛的候选清单。
- Treating automated-abuse detection and request quotas as the same control.
- Bot Protection evaluates automated behavior; Rate Limiting enforces a quota even for legitimate clients.
- Treating HTTP request filtering and automated-actor detection as interchangeable.
- Web Application Firewalls apply request rules; Bot Protection focuses on automated behavior and abuse.
- Treating attributable audit evidence and diagnostic application logs as one log stream.
- Audit Logs prioritize actor, action, integrity, retention, access, and review; Logging prioritizes diagnosis and operations.
- Treating identity proofing as another sign-in method.
- Identity Verification evaluates evidence about a real-world subject; Authentication establishes control of an account authenticator.
- Treating non-security linting and vulnerability detection as one static-analysis task.
- Linters & Static Analysis owns code quality; Vulnerability Scanning owns security findings across SCA, SAST, container, and IaC routes.
- Assuming a platform can make an organization legally compliant or guarantee certification.
- Compliance Automation is limited to security-control evidence and assurance workflows; it does not provide legal conclusions or guarantee audit outcomes.
暂缓引入
不要在产品真正需要之前引入专门系统。
No named security framework, customer assurance obligation, control owner, or evidence workflow exists.
Automation should follow defined controls and evidence requirements rather than create a generic claim of compliance.
Ordinary account authentication meets the product requirement and no proofing, geography, document, personhood, or regulated identity obligation exists.
Proofing adds sensitive evidence, privacy, failure, and exception-handling obligations that login alone does not require.
The software supply chain does not yet contain the corresponding dependency, source, container, or infrastructure-as-code surface.
Select SCA, SAST, container, and IaC routes only for artifacts the team actually owns and can triage.
Starter Stack
查看这些决策如何出现在完整应用起始方案中。
官方资源
支撑此分类边界的标准与一手文档。
来源
此决策地图使用的主张级参考资料。
- 1Secrets Management Cheat Sheet
OWASP · Accessed Official
- 2Automated Threats to Web Applications
OWASP · Accessed Official
- 3RFC 6585: Additional HTTP Status Codes
IETF · Accessed Official
- 4Web Application Firewall overview
Cloudflare · Accessed Official
- 5Open Security Controls Assessment Language
NIST · Accessed Official
- 6OSCAL layers and models
NIST · Accessed Official
- 7SP 800-92: Guide to Computer Security Log Management
NIST · Accessed Official
- 8SP 800-63A: Identity Proofing and Enrollment
NIST · Accessed Official
- 9SP 800-218: Secure Software Development Framework 1.1
NIST · Accessed Official
- 10Dependency-Check
OWASP · Accessed Official
- 11Code scanning with CodeQL
GitHub · Accessed Official
- 12SP 800-190: Application Container Security Guide
NIST · Accessed Official
- 13What is Checkov?
Checkov · Accessed Official