Reviewer focus
- How code changes are reviewed and validated
- How dependency and secret risks are managed in CI and deployment workflows
- How production changes are controlled and rolled back when needed
Implementation status (March 5, 2026)
Tero uses reviewed change workflows, automated checks, and controlled deployment paths.SDLC control baseline
| Control | Implementation |
|---|---|
| Code review | Tero requires peer review before merge |
| CI checks | Tero requires automated checks before merge and deploy |
| Testing | Automated tests run in CI workflows |
| Dependency risk | Vulnerability scanning in development and security workflows |
| Secrets hygiene | Tero manages secrets in dedicated secret systems |
| Deployment control | Controlled CI/CD paths and environment controls |
Change management expectations
- Tero reviews changes before merge.
- Production-impacting changes follow controlled rollout behavior.
- Tero rolls back failed deploys and tracks post-incident fixes to completion.
Hosted vs self-hosted boundary
| Area | Tero-hosted | Self-hosted |
|---|---|---|
| Product SDLC controls | Tero | Tero |
| Runtime deployment controls | Tero-operated | Customer-operated runtime |
| Infrastructure patching controls | Tero-operated | Customer-operated |
Evidence you can request
| Topic | Primary evidence |
|---|---|
| Runtime and architecture boundaries | Security Architecture |
| Access and secret handling | Identity and Access, Encryption and Key Management |
| Assurance posture | Compliance and Assurance |