empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 08:55:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

4392-update security best practices (#4395)

Browse Source 
We do use SAST tools, updating documentation to reflect.
This commit is contained in:
Guillaume Ross 2022-03-02 12:56:25 -05:00 committed by GitHub
parent c895bbb9eb
commit 1d38172435
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
docs/Using-Fleet/Security-best-practices.md
View File

@ -13,12 +13,16 @@ The Fleet community follows best practices when coding. Here are some of the way
### Describe your secure coding practices, including code reviews, use of static/dynamic security testing tools, 3rd party scans/reviews.
Every piece of code that is merged into Fleet is reviewed by at least one other engineer before merging. We don't use any security-specific testing tools.
Code commits to Fleet go through a series of tests, including SAST (static application security testing).
Every piece of code that is merged into Fleet is reviewed by at least one other engineer before merging.
The server backend is built in Golang, which (besides for language-level vulnerabilities) eliminates buffer overflow and other memory related attacks.
We use standard library cryptography wherever possible, and all cryptography is using well-known standards.
Libraries are inventoried and monitored for vulnerabilities. Our process for fixing vulnerable libraries and other vulnerabilities is available in our [handbook](https://fleetdm.com/handbook/security#vulnerability-management).
### SQL injection
All queries are parameterized with MySQL placeholders, so MySQL itself guards against SQL injection and the Fleet code does not need to perform any escaping.
@ -53,4 +57,4 @@ We render the frontend with React and benefit from built-in XSS protection in Re
We rely on Github's automated vulnerability checks, community news, and direct reports to discover vulnerabilities in our dependencies. We endeavor to fix these immediately and would almost always do so within a week of a report.
<meta name="pageOrderInSection" value="800">
<meta name="pageOrderInSection" value="800">