An extensible platform-as-a-service (PaaS) system is used during the software development lifecycle (SDLC) processes of an application. The system facilitates the process of getting security approval for the application. The system allows developers to use software bundles including software modules that are pre-approved. The system allows a developer to customize one or more software modules of the software bundle if necessary. The system monitors the development of the application to check if the developer customizes any software module to use a configuration that is not pre-approved. The system automatically generates a report noting the customization to the software module and requests the security team to review the modified configuration for security approval.