Basic security setup for startups

The application deployment is done in subnets based on its logic. However, the build/deploy engine is unable to reach orchestration or database endpoints from external networks. There are three ways to overcome this issue:

1. Deploy the build engine with build agents inside networks
2. Deploy the build agent and configure management with the pull model
3. Use the gitOps approach

Now that there is some codebase, it's time to conduct SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing). SAST tools like SonarQube, Snyk, and Fortify SCA, and DAST tools like Veracode, Acunetix, and Burp Suite can be used for this purpose. Some of these tools are cross-functional and can play both roles, the difference is only in the appliance stage.

Over several sprints, the product will be developed with a decent level of quality that can be delivered to demo users or shown to investors.