Enhance SECURITY.md with security tools and processes - #59
Conversation
Added a section on security tools and processes used in Hiero projects, including Snyk and StepSecurity, along with details on repo audits. Signed-off-by: Jessica G <jwagantall@linuxfoundation.org>
Added descriptions for Snyk and StepSecurity security tools. Signed-off-by: Jessica G <jwagantall@linuxfoundation.org>
|
|
||
| [This](https://github.com/hiero-ledger/hiero-enterprise-java/pull/12) is an example on StepSecurity scans and suggested solutions. | ||
|
|
||
| **Repo Audits** |
There was a problem hiding this comment.
What I'm missing here: Who is doing those audits and what must / should a project do based on the outcome. Audits outcomes can be seen as suggestions that an be ignored or concrete issues that must be fixed.
There was a problem hiding this comment.
@PavelSBorisov Can you please help complete the information that is missing on repo audits?
| - Step security forks actions that we use but are not actively maintained. This ensures we have updated, secure actions that are consistently maintained and protected rather than using old actions that may be abandonded. | ||
| - Additional features not covered in this PR. In general they're a good starting point for making the workflows as secure. | ||
|
|
||
| [This](https://github.com/hiero-ledger/hiero-enterprise-java/pull/12) is an example on StepSecurity scans and suggested solutions. |
There was a problem hiding this comment.
What I'm missing:
If Step security blogs a PR from being merged what is the escalation path and what is the max time until it is fixed and a pr can be merged. Assume a company brings in a project to hiero they depend on and step security issues does not allow them to create a release. With that we need clear rules a) who to report to and b) in what time that is fixed
There was a problem hiding this comment.
We had a situation like this where Sophie was trying to get past a PR that was blocking her. She was trying to reach Discord (hiero-maitainers-private channel) but no one replied to her. @nathanklick , can any of the release engineers please fill in the missing information and how they would prefer to be reached for cases like this?
|
|
||
| **Snyk** | ||
|
|
||
| [Snyk](https://snyk.io/) is a developer-friendly security platform designed to find and fix vulnerabilities in code, open-source dependencies, containers, and infrastructure-as-code (IaC). |
There was a problem hiding this comment.
As far as I know Snaky is only used for projects maintained by Hashgraph and no other project needs to use Snyk. If a project (like python-sdk) wants to use snyk can a new synk-account be created for that so that people can look in the snyk reports ?
There was a problem hiding this comment.
This is my understanding as well. We also have the public Snyk account which has the free plan and doesn't allow us to manage teams or features like the one Hashgraph owns. I need @nathanklick 's team to help us provide the information that needs to go in this section without compromising any private information or internal team procedures of any sort.
| - Explicitly setting permissions on workflows - prevents overpermissioned workflows. | ||
| - Pinning commit hashes rather than versions for all actions to ensure we don't update if a tag move to a malicious commit. | ||
| - Step security forks actions that we use but are not actively maintained. This ensures we have updated, secure actions that are consistently maintained and protected rather than using old actions that may be abandonded. | ||
| - Additional features not covered in this PR. In general they're a good starting point for making the workflows as secure. |
There was a problem hiding this comment.
What I miss here:
- StepSecurity will create PRs and add StepSecurity action as first action in any of your GitHub Action workflow. Those should be accepted since StepSecurity will than check secure the secrets of that repo
- What if a project brings in a new action but maintainers do not care on StepSecurity and not accept PRs by StepSecurity?
There was a problem hiding this comment.
Thank you @hendrikebbers , @nathanklick , can any of the release engineers please fill in the missing information?
jwagantall
left a comment
jwagantall
left a comment
There was a problem hiding this comment.
Added more comments, we need help from others to complete this documentation.
2 participants
Added a section on security tools and processes used in Hiero projects, including Snyk and StepSecurity, along with details on repo audits.
Fix: hiero-ledger/governance#589