What does 2.4 require?

Heuristic scanning tools are run over the code base to find embedded passwords and private keys, and anything found is removed in favour of a proper secret management approach. The check is part of routine verification rather than a one-off sweep.

NIST IR 8397 Guidelines on Minimum Standards for...

Other controls in Section 2: Recommended minimum standard for developer testing – NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software

2.1 Threat model early and use it to focus verification
2.10 Run a web application scanner where the software is a web application
2.11 Verify included software components and monitor them for known vulnerabilities
2.2 Automate verification
2.3 Run static (code-based) analysis
2.5 Run with language-provided checks and protection
2.6 Create black box test cases
2.7 Create code-based (structural) test cases and reach 80 percent statement coverage

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software controls