“They are very tactical items, very short documents that we put in GitHub issues as markdown with checkboxes and whatnot, and developers and operators can go through them very quickly and make sure they're compliant with our security principles.”

Transcript evidence from Julien Vehent -- Securing DevOps.