Update id and category

Signed-off-by: Bryan Frimin <bryan@frimin.fr>

controls/application-security/source-code/COD-001_patch_review.md

@@ -0,0 +1,34 @@
+---
+id: "APP-SRC-001"
+category: "application-security/source-code"
+revision-version: 1
+revision-date: "2024-01-07"
+estimate-time: "15m"
+frameworks:
+    - name: "soc2"
+      sections: ["CC1.4", "CC5.2", "CC8.1"]
+---
+
+## Purpose
+Requiring pull requests and code reviews ensures higher code quality
+and security by allowing multiple team members to catch bugs,
+inefficiencies, and potential vulnerabilities before code is
+merged. It also promotes collaboration, knowledge sharing, and
+accountability within the team. This process helps prevent issues in
+production and maintains adherence to coding standards.
+
+## Implementation
+
+### Github
+
+1. Open your GitHub repository and go to settings.
+2. In "Branche"s, click "Add Rule".
+3. Enter the branch name (e.g. "main") in the branch name pattern
+   field.
+4. Enable: "Require a pull request before merging"
+
+## Evidence
+
+- Screenshot of branch protection rules configuration
+- Documentation of PR review process
+- Sample PR showing enforced requirements

controls/application-security/source-code/COD-002_enable_code_scanning.md

@@ -0,0 +1,32 @@
+---
+id: "APP-SRC-002"
+category: "codebase"
+revision-version: 1
+revision-date: "2024-01-07"
+estimate-time: "15m"
+frameworks:
+    - name: "soc2"
+      sections: ["CC4.1", "CC8.1"]
+---
+
+## Purpose
+It ensures that potential security flaws are detected early. This
+proactive approach strengthens your security posture and helps
+maintain high code quality.
+
+## Implementation
+
+### Github
+
+1. Go to the "Security" tab of your repository.
+2. Click on "Set up code scanning".
+3. Select "Set up this workflow" under "CodeQL Analysis".
+4. Review the YAML file and commit it to your repository.
+
+Code scanning will now run every time code is pushed to the
+repository, and results will appear in the Security tab.
+
+## Evidence
+
+- Screenshot of code scanning results from Security tab
+- Sample of resolved security alerts