Skip to main content

Software development lifecycle

NEXT AI builds and ships software through a secure, repeatable Software Development Lifecycle (SDLC): changes are version-controlled in Git, reviewed by two developers, tested in a staging environment that mirrors production, and released through change control. Customer data is never used in staging or local development. Security issues follow defined SLAs.

Development environments​

  • Staging mirrors production for functional testing and QA.
  • No customer data is used in staging or local dev.

Version control & code review​

  • Git for history, traceability, and rollback.
  • All changes go through pull requests with manual review by two developers; automated tests must pass before merge.

Controls across the lifecycle (policy-driven)​

  • Defined phases: needs → requirements → design → build → evaluate → deploy.
  • Separation of duties: dev/test ≠ production; reviewers ≠ authors.
  • Change control: human approval; no auto-updates to prod without approval.
  • Secure coding: developers receive secure code training (incl. OWASP Top 10).
  • Testing: functional + security tests; boundary/edge cases required.
  • Test data: no production data in testing; tokenize/anonymize where needed.
  • Contracted work: secure-by-contract (design/coding/testing clauses, right-to-audit).

Standards alignment​

Security bugs and vulnerability handling​

  • Security bugs are prioritized and fixed under documented SLAs; see Vulnerability management for details.
  • Vulnerability management
  • Penetration testing
  • Incident response
  • Access control.

FAQ​

Q: Does NEXT AI ever use customer production data for testing or development?​

No. Staging/local environments never use customer data; test fixtures are synthetic or anonymized/tokenized.

Q: How many reviewers are required before code can ship?​

Two. Every pull request is manually reviewed by two developers and must pass automated tests before merge.

Q: What happens if a release needs an emergency fix?​

Emergency changes still follow change control (documented approval, review, and rollback readiness) before promotion to production.

Q: How does NEXT AI ensure secure coding practices?​

NEXT AI trains developers on secure coding (incl. OWASP Top 10) and requires peer review and security testing before release.

Q: Are development and production environments separated?​

Yes—logically and by role. Dev/test environments are separate from production, with controlled access and approvals for any prod change.

Q: Does NEXT AI have vulnerability SLAs?​

Yes. Security bugs follow defined timelines (e.g., Critical within 24h; High within 3 days). See the Vulnerability management page for the full table.

Q: How does NEXT AI handle third-party/contractor development?​

Contracts require secure design/coding/testing, right-to-audit, and proof that deliverables meet security thresholds before acceptance.

Q: What standards guide your SDLC overall?​

NEXT AI aligns practices with NIST SSDF and consults OWASP Top 10 for web-app risk coverage.