At the 10 a.m. standup, a dev offered ‘temporary whitelist’ as our risk treatment for a known SQL injection; I replied that ‘later’ is not a control in any framework I’ve read. What’s the most creative ‘mitigation’ you’ve had to translate into real secure SDLC work — extra credit if it involved a pipeline gate or a threat model?
.