This is the first major commit where they pulled in the existing codebase almost a year ago: https://bitbucket.org/cse-assemblyline/assemblyline/commits/ef004b

This is the first major commit where they pulled in the existing codebase almost a year ago: https://bitbucket.org/cse-assemblyline/assemblyline/commits/ef004b6bd7d24ee5a2664e62251092817db7eec2?at=master#chg-al/common/security.py https://bitbucket.org/cse-assemblyline/assemblyline/commits/... Couple interesting bits: 1. Bcrypt looks trusted. I guessed as much given that I've seen it used in other GC projects that were "Protected B" (think Revenue Canada / similar). 2. It doesn't look like they enabled HSTS by default until a couple months later in the repo: https://bitbucket.org/cse-assemblyline/assemblyline/commits/d874f39dd46185bc61680076e226acd555c1ffbd https://bitbucket.org/cse-assemblyline/assemblyline/commits/... Again, unsurprising since the CSE / CST main page doesn't have HSTS. 3. This part of the original version of the README is interesting: <README SNIPPET> #### License (or lack thereof) and Conditions of use As is fairly evident, we haven't selected a license for this project as of yet. As discussed when members were first granted read access to the repository, dissemination is based on the premise of originator controlled. If you feel there are other partners that would benefit from an early view and would be able to contribute, please contact the project leads and we should be able to sort it out. We will soon be splitting the platform and services into two separate repo's, so please treat the services as slightly more sensitive than the platform itself, ie: release it and perish!!! ... but seriously, we do not grant anyone the right to do anything other than deploy the platform and use it. No sharing, presenting, etc without our knowledge. We hope to have a clear release plan soon. </README SNIPPET> So it looks like they passed it around a bit either internally in the CSE or to a wider audience that may have included other departments. Probably getting more eyes on it to stop something stupid from going out. 4. There are some fun little commits like this: https://bitbucket.org/cse-assemblyline/assemblyline/commits/7907b5c217cfea5627d9dcf69d1080b7c2d66c30?at=master https://bitbucket.org/cse-assemblyline/assemblyline/commits/... Or this (adding the French version is always one of the last steps before something goes public): https://bitbucket.org/cse-assemblyline/assemblyline/commits/f51059f010bb2a87682112ea7d6817e957bcf029 https://bitbucket.org/cse-assemblyline/assemblyline/commits/... Or this (we've all been there): https://bitbucket.org/cse-assemblyline/assemblyline/commits/fe8d98795939aaa29fe60aad9aa1bcb4dc3ad957 https://bitbucket.org/cse-assemblyline/assemblyline/commits/...