Skip to content

Security Guidelines

Requirements scale with exposure — apply relevant points based on artifact type.

All Projects

  • No secrets in source code or version control; use a secrets manager or environment variables.
  • Pin dependency versions; run a vulnerability scanner in the pipeline (e.g., Trivy, OWASP Dependency-Check).
  • Fail the pipeline on high-severity findings that have a published fix; report findings without a fix rather than blocking on them. A base image regularly carries CVEs its distribution has not patched yet — no change in this repository resolves those, so gating on them only produces a permanently red job. Keeping base image tags current is the answer there, not the gate.
  • Keep dependencies up to date; automate with Dependabot or Renovate.

Services

  • Validate and sanitize all input at system boundaries (APIs, queues, file uploads).
  • Apply least-privilege to service accounts and database users.
  • Enforce TLS for all external communication; verify certificates.
  • Minimize attack surface — disable unused endpoints, features, and ports.
  • Rotate credentials and certificates automatically.
  • Audit-log security-relevant events (authentication, permission changes, sensitive data access).

Frontend Applications

  • Sanitize any raw HTML before rendering it (e.g. DOMPurify with dangerouslySetInnerHTML) — the main XSS vector.
  • Store auth tokens in httpOnly, secure, same-site cookies, not localStorage — XSS reads script-accessible storage.
  • Set a Content-Security-Policy header restricting script/style/connect sources; avoid unsafe-inline.
  • CORS is a backend concern; a static frontend has no server-side CORS policy to configure.
  • Treat every API, URL, or user-input value as untrusted until validated or escaped — including display-only values.

Directives

  • No secrets in source code or version control; use a secrets manager or environment variables
  • Pin dependency versions; run Trivy or OWASP Dependency-Check in CI; fail on high-severity vulnerabilities that have a published fix, report the unfixed ones without blocking
  • Validate and sanitize all input at system boundaries (APIs, queues, file uploads)
  • Apply least-privilege to service accounts and database users
  • Enforce TLS for all external communication; verify certificates
  • Audit-log security-relevant events (authentication, permission changes, sensitive data access)
  • Never inject raw HTML without sanitization; store auth tokens in httpOnly cookies, not localStorage; set a restrictive CSP