_index.md

Security Overview

This index links core security topics for the project. Each page is short, actionable, and owned.

Quick Links

• Headers & HTTPS → Headers & HTTPS hardening (HSTS, TLS, referrer-policy, cookies, CORS)
• Content Security Policy (CSP) → CSP: report-only to enforce
• Runbooks
  • Vulnerability intake & SLAs
  • Secret rotation
  • Incident response
  • CI failure triage
• Scanning
  • ZAP nightly baseline & triage
  • Code scanning (Dependabot/CodeQL)
• Disaster Recovery
  • DR plan
  • Backups & restore tests

Ownership

• Security owners: Platform Team
• Change control: changes via PR with CODEOWNERS review.

Last updated: 2025-01-27