Alefita AppSec methodology

Core model

Alefita's practice treats AppSec as an engineering system rather than a late audit. The recurring loop is:

understand business and boundaries -> model threats and ownership
-> test offensively -> diagnose root cause -> remediate at the right layer
-> retest -> encode the lesson as a standard, pipeline control or training
-> measure recurrence and residual risk

Durable principles

• The mobile or browser client is an untrusted presentation layer; authorization belongs server-side with the protected object and business action.
• Findings are incomplete without ownership, reproducible evidence, impact, remediation, retest and a durable control.
• Security by Design begins with requirements, trust boundaries, identity, authorization and failure modes.
• API governance is a scalable AppSec control plane: contracts, gateway policy, rate limiting, token validation, transport security and observability.
• Offensive testing is valuable when it closes the loop into architecture, developer enablement and prevention.
• The secure path should be the easiest path for delivery teams.
• Tools produce signals; engineering judgment determines risk and action.

RD Saúde pattern

The RD Saúde period shows the method operating at enterprise scale: penetration testing and vulnerability remediation led into Security by Design, API governance and a dedicated vulnerability-management capability. The Green-Mile work connected authorization failures, sensitive-data exposure, proxy behavior, client assumptions and remediation across client, gateway, service, data and process layers.

Capability map

• Offensive application security: mobile testing, dynamic instrumentation, traffic analysis, reverse engineering and business-logic abuse.
• Defensive engineering: authorization, API contracts, secure transport, secrets management, input validation, proxy hardening and regression testing.
• SDLC integration: requirements, design review, SAST/DAST/IAST/SCA, secret scanning, CI/CD gates, exceptions and evidence.
• Leadership: vulnerability ownership, developer onboarding, standards, prioritization, risk communication and trade-off decisions.
• Research: agent security, AI-assisted development, local infrastructure, sovereignty and reproducible experimentation.

Provenance

Consolidated from Wikifita's career and CAMDOM records plus private Drive materials including the career study, RD API/security governance materials, Green-Mile reports, proxy reports and pentest/SECaaS templates. Client-specific details remain in private source materials and should not be generalized beyond their evidence.