---
type: pesquisa
title: "Alefita AppSec methodology"
description: "Durable model of Alefita's application-security practice across offensive testing, architecture, SDLC and organizational controls."
tags: [appsec, security-by-design, devsecops, sdlc, methodology, rd-saude]
timestamp: "2026-07-20T18:30:00-03:00"
status: "consolidated"
---

# Alefita AppSec methodology

## Core model

Alefita's practice treats AppSec as an engineering system rather than a late audit. The recurring loop is:

```text
understand business and boundaries -> model threats and ownership
-> test offensively -> diagnose root cause -> remediate at the right layer
-> retest -> encode the lesson as a standard, pipeline control or training
-> measure recurrence and residual risk
```

## Durable principles

- The mobile or browser client is an untrusted presentation layer; authorization belongs server-side with the protected object and business action.
- Findings are incomplete without ownership, reproducible evidence, impact, remediation, retest and a durable control.
- Security by Design begins with requirements, trust boundaries, identity, authorization and failure modes.
- API governance is a scalable AppSec control plane: contracts, gateway policy, rate limiting, token validation, transport security and observability.
- Offensive testing is valuable when it closes the loop into architecture, developer enablement and prevention.
- The secure path should be the easiest path for delivery teams.
- Tools produce signals; engineering judgment determines risk and action.

## RD Saúde pattern

The RD Saúde period shows the method operating at enterprise scale: penetration testing and vulnerability remediation led into Security by Design, API governance and a dedicated vulnerability-management capability. The Green-Mile work connected authorization failures, sensitive-data exposure, proxy behavior, client assumptions and remediation across client, gateway, service, data and process layers.

## Capability map

- Offensive application security: mobile testing, dynamic instrumentation, traffic analysis, reverse engineering and business-logic abuse.
- Defensive engineering: authorization, API contracts, secure transport, secrets management, input validation, proxy hardening and regression testing.
- SDLC integration: requirements, design review, SAST/DAST/IAST/SCA, secret scanning, CI/CD gates, exceptions and evidence.
- Leadership: vulnerability ownership, developer onboarding, standards, prioritization, risk communication and trade-off decisions.
- Research: agent security, AI-assisted development, local infrastructure, sovereignty and reproducible experimentation.

## Provenance

Consolidated from Wikifita's career and CAMDOM records plus private Drive materials including the career study, RD API/security governance materials, Green-Mile reports, proxy reports and pentest/SECaaS templates. Client-specific details remain in private source materials and should not be generalized beyond their evidence.