How Changineers implements the Secure Development Policy: design, build, review, ship.
The Secure Development Policy is published in the Changineers trust portal. This page is the handbook index for the procedures that implement it. The beliefs that underpin those procedures are on Engineering principles.
What’s required
Section titled “What’s required”Engineering changes go through a design phase before code is written
for non-trivial work, and reach main through pull requests with
automated checks (tests, linting, dependency vulnerability scanning,
secrets scanning). Application security testing combines static
analysis on every PR with an external penetration test once a year.
External researchers can report vulnerabilities through a published
disclosure channel.
Implementing procedures
Section titled “Implementing procedures”| Topic | Page |
|---|---|
| How features are scoped, drafted, and approved before code is written | Solution design |
| Branch model, PR mechanics, CI gates, dependency and secret handling | Shipping code |
| Annual external penetration testing and how findings are tracked | Penetration testing |
| How external researchers can report security issues | Responsible disclosure |