Secrets and configuration

Required

• Keep secrets out of code

  APS-60

  Never write a password, key or token into code, settings files in the repo, or its history.

• Keep secrets out of the browser

  APS-61

  Send no private key to the browser. Anything in a page, script or source map can be read by anyone.

• Keep storage buckets private

  APS-63

  Keep cloud storage buckets and file shares private. Hand out short-lived signed links for single files instead of public folders.

• Close debug and admin doors

  APS-64

  Remove debug, test and status tools from production, or put them behind a login and a private network.

Recommended

• Give each key the least power

  APS-62

  Give every key, account and service only the access it needs. Use a separate key for each service and each environment.

• Serve no hidden files

  APS-65

  Serve only the files you meant to publish. Never serve version control folders, settings files, backups or folder listings.

• Remove defaults and samples

  APS-66

  Change every default password and remove sample apps, admin consoles and test pages before going live.

• Keep software current and quiet

  APS-67

  Keep the system, server and runtime on versions their makers still support. Install their security updates by the deadlines in fix each finding within the time its severity allows. Don't tell visitors which versions you run.

• Remove DNS records you no longer use

  APS-68

  Delete every DNS record that points at a server, bucket or hosted service you no longer own, before you give that resource up.