For SSDF PW.7 and PW.8, you show that you decided which reviews, analysis and tests to use, ran them, and recorded and triaged every issue in your workflow system. Evidence is a written decision, review and test results, and tracked findings with root causes.
What the tasks require
| Task | In plain words |
|---|---|
| PW.7.1 | Decide whether code review and or code analysis should be used |
| PW.7.2 | Perform it against secure coding standards, record and triage all issues in the team workflow |
| PW.8.1 | Decide whether executable code testing is needed and which types |
| PW.8.2 | Scope, design, perform and document tests, recording and triaging issues |
Note the pattern: first a documented decision, then performance, then tracked results.
Review and analysis evidence
PW.7 examples include peer review that also considers existing analysis results, expert reviewers checking for backdoors and malicious content, static analysis with a human reviewing the reported issues, review checklists, and automated tools that check code as it is committed. It also suggests documenting root causes and lessons learned.
Keep: review records with reviewer and date, static analysis reports, the issues opened from them.
Testing evidence
PW.8 examples include functional tests of security features, dynamic vulnerability testing in the automated suite, tests for previously reported vulnerabilities so they are not reintroduced, fuzz testing for input handling, and penetration testing for high risk scenarios where resources allow.
Keep: the test plan, results per release, regression tests tied to past issues.
A simple evidence set
- One page stating when review, analysis and testing apply and which kinds.
- Pull requests showing review and tool results.
- A findings list with status, owner and dates.
- A root cause note for serious findings.
- Regression tests added after fixes.
Try it yourself
Open the demo and run a web app scan. See how findings carry severity and location, the fields that make triage records useful.
Click through it at your own pace, or open it full screen.
Quick check
Do we have to use every test type in PW.8?
No. PW.8.1 asks you to decide whether testing is needed and which types, so a documented, reasoned choice is the evidence.
Does a clean scan satisfy PW.7?
It helps, but PW.7.2 also asks for recorded and triaged issues. Keep the report and the handling record.
Where tooling helps
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates that record results on pull requests. Review and triage remain human decisions. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
