Supply chain and setup

Required

• Lock and audit dependencies

  Required

  Commit a lock file, install from it exactly, and fail the build on known holes in any dependency.

• Review every new package

  Required

  Check every new dependency before adding it. Attackers publish packages with names close to popular ones, and take over abandoned ones.

• Load third-party scripts safely

  Required

  Host scripts yourself where you can. When a script must come from another server, pin its version and add an integrity hash.

• Keep secrets out of builds from strangers

  Required

  Never give deploy keys or other secrets to builds that run code from outside contributors. Give each build job only the access it needs.

• Remove defaults and samples

  Required

  Change every default password and remove sample apps, admin consoles and test pages before going live.

• Keep software current and quiet

  Required

  Install security updates for the system, the server and the language runtime quickly. Don't tell visitors which versions you run.

• Log attacks without personal data

  Required

  Log failed logins, refused access and rate limit hits, and alert on spikes. Keep personal data out of the log.

• Send the security headers

  Required

  Send the browser security headers on every page, including a strict Content Security Policy, HSTS and nosniff.

Recommended

• Plan attacks before building

  Recommended

  Before building a feature, write down what an attacker would want from it and how they could get it. Then design those paths away.

• Publish what is in each release

  Recommended

  Make a software bill of materials for every release, and sign where and how the build was made.