🔐 Security Section #3
Conversation
I've started with a basic outline for topics I think are important and given some of them the basis of guidance, or some bullet points of topics that can be expanded on later.
I mentioned the practice, but did not realise it has a term. This commit includes the feedback from @ctcpip to reference the practice
|
There is work going on in the Security Collaboration Space at the OpenJS Foundation to help give guidance to JavaScript developers around security as well. Part of our plan is go take guidance and direction from the OpenSSF and tailor it to JS projects. That being said, we may want to highlight some of the resources at OpenSSF for the time being might be good. A couple examples:
Note: the Security Collab Space is something of a new effort and there isn't a lot in the repo. We have shifted a lot of our focus at the moment on standing up the grant we received from the Sovereign Tech Fund. See more info on that grant here: https://openjsf.org/blog/2023/05/02/openjs-foundation-receives-major-government-investment-from-sovereign-tech-fund-for-web-security-and-stability/ |
|
@joesepi are you suggesting that we include some OpenSSF links as a separate section for external resources or, do you think it should be included in one of the existing titles? |
- Include new section on relevant sections from Node.js Reference Architecture and include links to that asset in that section - Edit the header section to include IBM/RedHat value-add i.e. how IBM/RedHat have found benefit in using the headers and how we go about using them and setting the policy - Add commentry from the team on threat modeling to enhance this section into its own titled topic including mentions to tools like Threat Dragon and the STRIDE method of threat analysis - Include cookies as its own headed topic - Add OAuth as a note, though this is something @roastlechon may want to add to
… into doc/security
This commit takes the bullet points on keeping secrets secure, and bot detection and fleshes them out with content, guidance and tools that have been used by the team.
Not sure the way of working previously, but I like my teams to raise PRs at the beginning to allow for early feedback.
This WIP PR will be used for my draft of the security section, as taken on at the meeting on 2023/06/21.