4 ms·
Do you have a recommended security checklist for something like this? I remember seeing an old github repo with a bunch of good information but I cannot seem to
by figgis 9y ago
Do you have a recommended security checklist for something like this? I remember seeing an old github repo with a bunch of good information but I cannot seem to find it and my search results are... unhelpful at best.
- neuland 9y agoChecklists are cool and all. But, you shouldn't need a checklist to know that you shouldn't ship API keys.
- figgis 9y agoCan't disagree with that.
- petee 9y agoCheck out OWASP cheatsheets and guides: https://www.owasp.org/ https://www.owasp.org/
- tachion 9y agoYou wont like it, but... How would you feel being asked for a checklist for 'good software development' or something similar by a cooking chef? Hire skilled and dedicated DevOps/SRE/SysAdmin/hype-of-the-week person. ;)
- tachyoff 9y ago100% this. I’ve been transitioning to doing more devops/admin work for the past several months and it’s amazing the stuff people are willing to put into production. Like no, maybe we shouldn’t be committing that secret to Github. Dedicated operations critters are essential for any kind of service.
- figgis 9y agoA chef cooking something unfamiliar will look up the dish they are cooking. If your cookbook can't handle a checklist of common pitfalls and overlooked actions to take then it isn't much of a cookbook. (granted not putting your secrets in a public repo is definitely a given.)