Change Management and Secure SDLC Policy

1. Policy Statement

Deseo Developers LLC maintains a defined change and release management process for Finducation applications, including EZBudget. Production changes are version-controlled, reviewed before merge when multiple contributors are involved, built through a documented deployment pipeline, and subject to secure coding standards.

2. Scope

• Application source code and configuration in the Finducation Git repository
• Netlify build and deploy pipeline for production
• Serverless functions, client applications, and shared libraries
• Security-relevant dependency and configuration changes

3. Source Control and Change Tracking

• All production code is maintained in Git with commit history.
• The canonical production branch is main.
• Changes are introduced via commits (and pull requests when collaborators contribute).
• Deployments to production are triggered from the repository through Netlify continuous deployment.

4. Release Management

4.1 Build Pipeline

• Production builds run via Netlify using the documented build command in netlify.toml (install dependencies, build packages, build EZBudget artifacts).
• Failed builds do not publish a successful production deploy.
• Node runtime version for builds is pinned in Netlify configuration.

4.2 Authorization to Deploy

• Only authorized maintainers with repository and Netlify access may merge to main or trigger production publishes.
• Access to production deploy and environment secrets is limited to the engineering owner(s) under the Access Control Policy (EZB-ACM-001).

5. Code Review and Approval

• Deseo Developers LLC is currently a sole-operator organization; the same individual authors and deploys changes.
• Before production deploy, the operator performs a self-review checklist covering secrets exposure, authentication checks, input validation, and impact on Plaid / Stripe / auth flows.
• If collaborators are added later, security-sensitive changes will require review by an authorized maintainer before merge to main.
• Destructive or high-risk changes (schema migrations, RLS policy changes, production secret rotation) are scheduled and verified post-deploy.

6. Secure Software Development Practices

• Engineering follows documented secure coding guidance in repository security documentation (e.g., SECURITY.md and related security docs).
• Secrets and API keys are not committed to source control; production secrets are stored in Netlify/Supabase environment configuration.
• Server-side handlers validate authentication for protected routes and avoid logging secrets or full financial account numbers.
• HTTP security headers (CSP, frame denial, content-type sniffing protection) are applied at the Netlify edge for production responses.
• A repository SQL injection pattern check script (scripts/security-check-sql.js) is part of the local/automated test suite and is expected to pass before production release.

7. Testing Expectations

• Functional and security-oriented scripts defined in package.json (including npm test) are run before material production releases.
• Additional manual verification is performed for Plaid Link, authentication, and billing-critical flows when those areas change.

8. Dependency and Composition Awareness

• Third-party npm packages are reviewed before adoption for production use.
• Maintainers periodically review dependency advisories (e.g., npm audit) and apply updates for high-severity issues affecting production packages (see Vulnerability Management Policy, EZB-VUL-001).

9. Rollback

• Netlify deploy history is used to restore a prior known-good production deploy when a release introduces a material defect or security regression.
• Incident follow-up uses the Incident Response Policy (EZB-IR-001).

10. Periodic Review

• This policy is reviewed at least annually and after significant pipeline or architecture changes.
• Planned improvements (CI-enforced checks on every pull request, Dependabot, expanded static analysis) are tracked in the security implementation roadmap and adopted when operationalized.

11. Related Documents

• Information Security and Governance Policy (EZB-ISG-001)
• Vulnerability Management Policy (EZB-VUL-001)
• Incident Response Policy (EZB-IR-001)
• Access Control Policy (EZB-ACM-001)

12. Approval

Approved By: Deseo Developers LLC — Authorized Representative

Date: July 22, 2026

Contact: contact@deseodevelopers.com