Skip to content
This repository has been archived by the owner on Nov 24, 2023. It is now read-only.

Latest commit

 

History

History
83 lines (53 loc) · 3.02 KB

SECURITY.md

File metadata and controls

83 lines (53 loc) · 3.02 KB
Raw

Security policy

  1. Reporting security problems to PRTriage
  2. Security Point of Contact
  3. Incident Response Process
  4. Vulnerability Management Plan

Reporting security problems to PRTriage

CREATE AN ISSUE to report a security problems.

Security Point of Contact

The security point of contact is Sam Yamashita. Sam responds to security incident reports as fast as possible, within one business day at the latest.

If Sam does not respond then please contact support@github.com who can disable any access for the PRTriage app until the security incident is resolved.

Incident Response

In case an incident is discovered or reported, I will follow the following process to contain, respond and remediate:

1. Containment

The first step is to find out the root cause, nature and scope of the incident.

  • Is still ongoing? If yes, first priority is to stop it.
  • Is the incident outside of my influence? If yes, first priority is to contain it.
  • Find out knows about the incident and who is affected.
  • Find out what data was potentially exposed.

One way to immediately remove all access for the PRTriage app is to remove the private key from the PRTriage App Settings page. The access can be recovered later by generating a new private key and re-deploy the app.

2. Response

After the initial assessment and containment to my best abilities, I will document all actions taken in a response plan.

3. Remediation

Once the incident is confirmed to be resolved, I will summarize the lessons learned from the incident and create a list of actions I will take to prevent it from happening again.

Vulnerability Management Plans

Keep permissions to a minimum

The PRTriage App uses the least amount of access to limit the impact of possible security incidents, see Information collection and use.

If someone would get access to the PRTriage app, the worst thing they could do is to read out contents from pull requests, limited to repositories the PRTriage got installed on.

Secure accounts with access

The PRTriage GitHub Organization requires 2FA authorization for all members.

Critical Updates And Security Notices

We learn about critical software updates and security threats from these sources

  1. GitHub Security Alerts
  2. GitHub: https://status.github.com/ & @githubstatus
  3. Dependabot (Dependency management for general): https://dependabot.com/ & @dependabot
  4. Snyk (Dependency management for security): https://snyk.statuspage.io/ & @snyksec
  5. Travis (Continuous Integration): https://www.traviscistatus.com/ & @traviscistatus
  6. Heroku (Hosting): https://status.heroku.com/ & @herokustatus