CISA Cloud Security Technical Reference Architecture v2.0 4.4b: Test security automatically in the pipeline and layer expert, third-party and public vulnerability disclosure on top

What does 4.4b require?

Application security testing, static analysis for coding flaws such as injection and dynamic testing of the running code, runs inside the pipeline so issues are fixed before release, with infrastructure definitions also scanned so that unexpected open ports are caught before exposure; this is one layer alongside manual expert analysis, third-party testing and a vulnerability disclosure policy with bug bounties under the binding operational directive on vulnerability disclosure.