What it means
Deployment security covers release authorization, environment separation, infrastructure configuration, secrets, database changes, feature flags, health checks, monitoring, and recovery.
Why it matters
A secure application can still fail if deployment introduces weak defaults, wrong permissions, exposed secrets, or unverified artifacts.
Practical focus
- Verify artifact identity and integrity
- Use repeatable deployment automation
- Separate duties and production privileges
- Test rollback, monitoring, and post-deployment validation
Common mistakes
- Making manual production changes outside the pipeline
- Deploying with development defaults
- Sharing administrator credentials
- Treating successful startup as proof of a safe release
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: