Secure Development

Last reviewed: March 5, 2026 Owner: Security + Engineering Review cadence: Quarterly Status: Implemented This page covers the engineering controls Tero applies before changes reach production.

​

Reviewer focus

• How code changes are reviewed and validated
• How dependency and secret risks are managed in CI and deployment workflows
• How production changes are controlled and rolled back when needed

​

Implementation status (March 5, 2026)

Tero uses reviewed change workflows, automated checks, and controlled deployment paths.

​

SDLC control baseline

​

Change management expectations

• Tero reviews changes before merge.
• Production-impacting changes follow controlled rollout behavior.
• Tero rolls back failed deploys and tracks post-incident fixes to completion.

​

Hosted vs self-hosted boundary

​

Evidence you can request

​

Exceptions and governance

Any SDLC control exception requires documented approval, compensating controls, and remediation timing. Evidence requests: