Skip to content

Security Guidelines

Requirements scale with exposure — apply relevant points based on artifact type.

All Projects

  • No secrets in source code or version control; use a secrets manager or environment variables.
  • Pin dependency versions; run a vulnerability scanner in the pipeline (e.g., Trivy, OWASP Dependency-Check).
  • Fail the pipeline on high-severity findings that have a published fix; report findings without a fix rather than blocking on them. A base image regularly carries CVEs its distribution has not patched yet — no change in this repository resolves those, so gating on them only produces a permanently red job. Keeping base image tags current is the answer there, not the gate.
  • The scan stays a gate, so that no vulnerable image reaches production. Turning it into a warning is an exception, which the project's security experts decide on. It fits when a fix exists in principle but not yet in the upstream image or package the project depends on, so that the gate would block all work without anyone in the project being able to act. A finding alone does not make the software attackable: that depends on its attack vector, such as whether the vulnerable part of a library is used at all or the affected port is open. Record the exception next to the scan job, with its reason.
  • Keep dependencies up to date; automate with Dependabot or Renovate.

Services

  • Validate and sanitize all input at system boundaries (APIs, queues, file uploads).
  • Apply least-privilege to service accounts and database users.
  • Enforce TLS for all external communication; verify certificates.
  • Minimize attack surface — disable unused endpoints, features, and ports.
  • Rotate credentials and certificates automatically.
  • Audit-log security-relevant events (authentication, permission changes, sensitive data access).

Frontend Applications

  • Sanitize any raw HTML before rendering it (e.g. DOMPurify with dangerouslySetInnerHTML) — the main XSS vector.
  • Store auth tokens in httpOnly, secure, same-site cookies, not localStorage — XSS reads script-accessible storage.
  • Set a Content-Security-Policy header restricting script/style/connect sources; avoid unsafe-inline.
  • CORS is a backend concern; a static frontend has no server-side CORS policy to configure.
  • Treat every API, URL, or user-input value as untrusted until validated or escaped — including display-only values.

Directives

  • No secrets in source code or version control; use a secrets manager or environment variables
  • Pin dependency versions; run Trivy or OWASP Dependency-Check in CI; fail on high-severity vulnerabilities that have a published fix, report the unfixed ones without blocking
  • Only the project's security experts turn the scan gate into a warning, as an exception for fixes not yet in the upstream image or package, after weighing the attack vector; record it at the job
  • Keep dependencies up to date; automate with Dependabot or Renovate
  • Validate and sanitize all input at system boundaries (APIs, queues, file uploads)
  • Apply least-privilege to service accounts and database users
  • Enforce TLS for all external communication; verify certificates
  • Minimize attack surface (disable unused endpoints/features/ports); rotate credentials and certificates automatically
  • Audit-log security-relevant events (authentication, permission changes, sensitive data access)
  • Never inject raw HTML without sanitization; store auth tokens in httpOnly cookies, not localStorage; set a restrictive CSP
  • CORS is a backend concern, not a static frontend's
  • Treat every API/URL/user-input value as untrusted, including display-only values