Code Quality/Security Initiative [PI-9]

[lewisdaly]

Incremental improvements to tooling and processes to secure the Mojaloop codebase, and improve code quality.

Goals:

Note: this list is still in discussion

• publish a security tool list summary
• define baseline configuration and security policies for containers
• define a vulnerability disclosure procedure
• define GDPR scope and plan an assessment
• investigate the feasibility of deploying a cloud based HSM for secure storage of secrets,
• solicit devsecops input from implementors
• continuous tool research
• refresh and update documentation

Acceptance Criteria

• TBD

Scope:

• Still under discussion