Wonder Security & Trust
Secure Development
Secure Development
Secure Development
Imagine combines secure-development practices, automated vulnerability scanning, professional security oversight, and independent penetration testing.
| Control | Current practice |
|---|---|
| Secure development training | Secure-development and information-security training delivered by Persist Security, including OWASP Top 10 and common application-security risks |
| Security governance | Development is subject to Imagine's organizational information-security policies and security risk-management process |
| Security review | Application security controls are periodically reviewed with the company's security function |
CI/CD & Change Management
Imagine uses separate Staging and Production deployment flows. Backend releases are built through GitHub Actions, packaged as container images, stored in AWS ECR, and deployed to AWS ECS Fargate.
| Control | Configuration |
|---|---|
| Source control | GitHub |
| Deployment pipeline | GitHub Actions → AWS ECR → AWS ECS Fargate |
| Environment separation | Separate Staging and Production deployment branches and ECS services |
| Build validation | Production deployment requires a successful application/container build |
| Code review | Pull requests are used for change review; enforcement is being strengthened |
| Deployment controls | Additional branch protection and deployment gating are being hardened |
Status: Hardening in progress
Vulnerability Management & Security Testing
Imagine performs application security testing using automated vulnerability scanning and independent security testing.
| Control | Current practice |
|---|---|
| Dependency scanning | Snyk Open Source (SCA) scanning of backend and frontend dependencies |
| Static application security testing | Snyk Code (SAST) scanning of backend source code |
| Latest Snyk review | February 2026 — no open findings in the completed backend dependency, frontend dependency, and backend source scans |
| Scanning cadence | Security scans are currently performed as periodic reviews; continuous CI integration is being introduced |
| Penetration testing | Independent penetration testing performed by Persist Security |
| Remediation | Security findings are reviewed and tracked through the vulnerability-management process |