@catladder/cli
Version:
Panter cli tool for cloud CI/CD and DevOps
118 lines (117 loc) • 4.32 kB
JSON
[
{
"description": "No API keys or secrets are stored in repository",
"responsibles": 1,
"more": ""
},
{
"description": "The app does not provide password login",
"responsibles": 1,
"more": ""
},
{
"description": "Passwords are not stored",
"responsibles": 1,
"more": ""
},
{
"description": "No sensitive information (passwords, keys, user data, ...) is logged or traced",
"responsibles": 1,
"more": "[Logging guide](https://www.notion.so/panterch/Long-story-logging-022722bb878f4724ae5b49e17667b630?pvs=4#9e5a36b7158a4953b73ec6a345bd8989), [Tracing guide](https://www.notion.so/panterch/Long-story-tracing-d8a9ec1ac2ff4fa78cefa8991233224e?pvs=4#535121b5bf9741fbaf8654b4b64d879d)"
},
{
"description": "Passwords are stored hashed with salt and salt is not stored in the repository",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/hash.md)"
},
{
"description": "Input that ends up in DOM is properly sanitized",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/xss.md)"
},
{
"description": "All user inputs have reasonable validations",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/validation.md)"
},
{
"description": "The app is not using cookies",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cookies.md)"
},
{
"description": "The app is using cookies and cookies are properly configured",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cookies.md)"
},
{
"description": "The app uses JWT with a secret and the secret is not stored in the repository",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cookies.md)"
},
{
"description": "Authorization and user roles (RBAC) were reviewed thoroughly",
"responsibles": 2,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/authorization.md)"
},
{
"description": "CORS headers do not use `*`",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cors.md)"
},
{
"description": "CSP headers are properly configured (no `unsafe-inline` or `unsafe-eval`)",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/csp.md)"
},
{
"description": "DoS defense mechanism is implemented",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/dos.md)"
},
{
"description": "YAML/XML parsing is not used or used YAML/XML parsers have disabled DTD",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/dos.md)"
},
{
"description": "The app implements CSRF prevention",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/csrf.md)"
},
{
"description": "The app has a rate limitter",
"responsibles": 1,
"more": ""
},
{
"description": "The app has disabled GraphQL introspection and schema registry",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/graphql.md)"
},
{
"description": "The app has set GraphQL complexity query limits",
"responsibles": 1,
"more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/graphql.md)"
},
{
"description": "`sitemap.xml` does not leak any routes with sensitive data",
"responsibles": 1,
"more": ""
},
{
"description": "Cloud storage is (private) configured to not leak any sensitive data publicly",
"responsibles": 1,
"more": ""
},
{
"description": "Security Dashboard checks weekly vulnerable dependencies https://dep.panter.swiss/",
"responsibles": 1,
"more": ""
},
{
"description": "The app has `.well-known/security.txt` https://securitytxt.org/",
"responsibles": 1,
"more": ""
}
]