Skip to content

Security

TODO(David)

Write this page. Stub created 2026-10-11 for structure only. It will gather the security principles and standards that are now spread over the project: the Security Principles section of the Principles page, Section 7, and the security parts of the standards pages.

The security principles behind these standards are stated under Security Principles on the Principles page. This page holds the one that has a page of its own.

Nothing Secret in Version Control

Nothing is deployed, and nothing is written into code, that a person could use after gaining access to the code repository. The repository holds no password, no key, no token, and no authorisation URL: not in code, not in metadata, and not in a configuration file.

  • A credential is kept in a store that the platform or GitHub protects, such as an External Credential or a GitHub secret, and is read from there (Credential Storage).
  • Every change is scanned for credentials, by a secret scanner and by rules of the code scan (Secret Scanning).