Security Documentation#49
Conversation
| ### [Operations](./operations/incident-response.md) | ||
|
|
||
| How we operate and respond to security events. | ||
|
|
||
| - [Incident Response](./operations/incident-response.md) - Triage, response, notification | ||
| - [Access Control](./operations/access-control.md) - Internal access principles |
There was a problem hiding this comment.
I did not have much to go on here.
@ericmj Could we collaborate to make this accurate?
|
|
||
| ### Production | ||
|
|
||
| <!-- TODO: Verify production secrets management --> |
There was a problem hiding this comment.
I can add you to the hexpm-ops that holds our terraform, kubernetes, and fastly configuration if that would help verification.
There was a problem hiding this comment.
That would be great, yes.
|
|
||
| ### Access Control | ||
|
|
||
| <!-- TODO: Verify least privilege implementation --> |
ericmj
left a comment
ericmj
left a comment
There was a problem hiding this comment.
This is really great, thank you! I added a couple of comments and questions.
|
|
||
| ### Production | ||
|
|
||
| <!-- TODO: Verify production secrets management --> |
There was a problem hiding this comment.
I can add you to the hexpm-ops that holds our terraform, kubernetes, and fastly configuration if that would help verification.
|
|
||
| ## Deployment Controls | ||
|
|
||
| Deployments are performed manually by core maintainers outside of GitHub infrastructure. |
There was a problem hiding this comment.
Our deployments happens through CI on hexpm-ops. We also have a Slack bot that can deploy, monitor deployments, and monitor container image builds. That's on https://github.com/hexpm/hexpm_deploy, I can add you to that too.
| Dev-->>Client: TOTP code | ||
| else Has API Key | ||
| Note over Client: Use API key directly | ||
| opt 2FA Enabled on Account |
| Client->>Client: Read repo config from mix.exs | ||
| Client->>Client: Identify private repos (org: "mycompany") | ||
|
|
||
| Note over Client,API: Authenticate for private repo |
There was a problem hiding this comment.
Should we show OAuth flow here also?
2 participants
Add Security Documentation around Hex.pm.