Show HN: We have just released our first Debloating tool for Containers

I have some thoughts here, if the team needs their tool to be well recognized, they must adopt any of the industry best practices for security benchmarks. As I believe that the software should address security concerns, as it addresses performance concerns, or its intended business need. Security is the hot potato, by which companies are leveraging and developing their spaces in the market. It is one of the key principles by which big companies are deciding to go forward or reject new software.<p>Beginning with the Container Security, I suggest NIST Special Publication 800-190 for Container Security to be adopted; &quot;<a href="https:&#x2F;&#x2F;csrc.nist.gov&#x2F;pubs&#x2F;sp&#x2F;800&#x2F;190&#x2F;final" rel="nofollow">https:&#x2F;&#x2F;csrc.nist.gov&#x2F;pubs&#x2F;sp&#x2F;800&#x2F;190&#x2F;final</a>&quot; While NIST publications&#x2F;standards are extremely recognized and followed in the US, they are considered an industry best practice worldwide.<p>Thanks, Waleed Waheed. SR Mgr GRC, RSA Security.

Third thought, adopting the principles of the CISA (Cybersecurity and Infrastructure Security Agency) Secure By Design Pledge, even if the new startup is not intended to sign the pledge with CISA it is very beneficial to take the pledge&#x27;s principles into consideration. Big and Giant Software manufacturers are signing this pledge with CISA. <a href="https:&#x2F;&#x2F;www.cisa.gov&#x2F;securebydesign&#x2F;pledge" rel="nofollow">https:&#x2F;&#x2F;www.cisa.gov&#x2F;securebydesign&#x2F;pledge</a><p>Thanks, Waleed Waheed. Sr Mgr GRC, RSA Security.

Fourth and final thought - for now-, from a cost-benefit analysis standpoint, it is not beneficial to hire full time Application Security personnel. BUT, it is extremely beneficial to have someone overlooking the tool&#x2F;SW from an application security perspective, either on an ad-hoc or part-time basis. That&#x27;s very important to have a secure software, trusted by the purchasing entities.<p>Thanks, Waleed Waheed. Sr Mgr GRC, RSA Security.

Second thought, I would like to recommend adopting a Secure Development Lifecycle approach. Going for NIST related framework also (SP 800-218), I recommend adopting the principles of this framework: <a href="https:&#x2F;&#x2F;csrc.nist.gov&#x2F;pubs&#x2F;sp&#x2F;800&#x2F;218&#x2F;final" rel="nofollow">https:&#x2F;&#x2F;csrc.nist.gov&#x2F;pubs&#x2F;sp&#x2F;800&#x2F;218&#x2F;final</a><p>Thanks, Waleed Waheed Sr Mgr GRC, RSA Security.