Is 14.1.1 in scope for ASVS?

[tghosth]

#	Description	L1	L2	L3	CWE
14.1.1	Verify that the application build and deployment processes are performed in a secure and repeatable way, such as CI / CD automation, automated configuration management, and automated deployment scripts.		✓	✓

This feels like more of a process thing than a secure application thing. I would be inclined to drop it.

cc; @meghanjacquot @jmanico @elarlang

[elarlang]

previously touched in #1527

As it is written, it is out of scope for me.

Now, the question is what we may loose if in the end product (the application) if we don't require it? Maybe we need to cover those aspects (if there are any) some other way.

[meghanjacquot]

I propose moving it to be part of V1 in section 1, but to be less prescriptive change the "and" to an "or" and add etc. I am in support of dropping it from V14.

[elarlang]

I can not see material for V1, see my comment here #2088 (comment)

[meghanjacquot]

I propose moving it to be part of V1 in section 1, but to be less prescriptive change the "and" to an "or" and add etc. I am in support of dropping it from V14.

Since I understand more about what V1 is going to become, then I amend this and am fine with the proposal to drop it from V14.

[tghosth]

Opened #2105