Explanation
The correct answer is B, C, and D, because they are all security best practices for Splunk app development.
Storing passwords in clear text in .conf files is not a security best practice, because it exposes the passwords to unauthorized access or leakage. Implementing security in software development lifecycle means applying security principles and practices throughout the app development process, from design to deployment.
Manually testing application with the controls listed in the OWASP Security Testing Guide helps to identify and mitigate common security risks and vulnerabilities in web applications. Using a dynamic scanner such as OWASP ZAP to scan web application components for vulnerabilities helps to automate the security testing and find potential issues that might be missed by manual testing.