Secure Development

Imagine combines secure-development practices, automated vulnerability scanning, professional security oversight, and independent penetration testing.

Control	Current practice
Secure development training	Secure-development and information-security training, including OWASP Top 10 and common application-security risks
Security governance	Development is subject to Imagine's organizational information-security policies and security risk-management process
Security review	Application security controls are periodically reviewed with the company's security function

CI/CD & Change Management

Imagine uses separate Staging and Production deployment flows. Backend releases are built through GitHub Actions, packaged as container images, stored in AWS ECR, and deployed to AWS ECS Fargate.

Control	Configuration
Source control	GitHub
Deployment pipeline	GitHub Actions → AWS ECR → AWS ECS Fargate
Environment separation	Separate Staging and Production deployment branches and ECS services
Build validation	Production deployment requires a successful application/container build
Code review	Pull requests are used for change review; enforcement is being strengthened
Deployment controls	Additional branch protection and deployment gating are being hardened

Vulnerability Management & Security Testing

Imagine performs application security testing using automated vulnerability scanning and independent security testing.

Control	Current practice
Dependency scanning	Snyk Open Source (SCA) scanning of backend and frontend dependencies
Static application security testing	Snyk Code (SAST) scanning of backend source code
Latest Snyk review	February 2026 — no open findings in the completed backend dependency, frontend dependency, and backend source scans
Scanning cadence	Security scans are currently performed as periodic reviews; continuous CI integration is being introduced
Penetration testing	Independent penetration testing performed by qualified third-party assessors
Remediation	Security findings are reviewed and tracked through the vulnerability-management process