Security strengthened by iteration, and transparency
May 18, 2020Heather Simpson
Summary
This post details the work of a senior application security engineer, focusing on identifying and mitigating vulnerabilities in GitLab's codebase. Key initiatives include developing automated testing for permission bugs, reviewing APIs for information leaks, and building expertise in the Verify and Release stages. The engineer also emphasizes the importance of the principle of least privilege and the benefits of transparency in enhancing product security.
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting