Skip to content

process.md

Latest commit

 

History

History
131 lines (93 loc) · 3.58 KB

process.md

File metadata and controls

131 lines (93 loc) · 3.58 KB
Raw

Secure Process

This document describes secure development process practices for Hex registry infrastructure.

Code Review

Requirements

Code review requirements are enforced through GitHub rulesets. See the repository rulesets for the authoritative configuration.

Repository Status
hexpm/hexpm Active
hexpm/hex Active
hexpm/hex_core Active
hexpm/hex_solver Active
hexpm/hexdocs Active
hexpm/preview Active
hexpm/diff Active
hexpm/specifications Active
hexpm/bob None
hexpm/hexdocs-search None

Ruleset Configuration (hexpm)

Rule Configuration
CodeQL All security alerts, all general alerts
Zizmor All security alerts, all general alerts
Code quality All severity levels enforced
Bypass No bypass permissions configured

Security Considerations

Reviewers evaluate:

  • Authentication and authorization boundaries
  • Input validation at trust boundaries
  • Output encoding to prevent injection
  • Cryptographic usage
  • Secrets handling

Quality Assurance

Testing

Test Type Coverage Notes
Unit tests All projects Required for changes
Integration tests Hex client against hexpm Matrix across Hex versions
Property-based tests hex_core proper framework

Compatibility Testing

Projects are tested against:

Hex Client Integration

The Hex client is integration tested against the hexpm registry.

CI Gates

Check Enforcement
All CI checks pass Required
CodeQL security scan Required
Zizmor workflow scan Required
Code review Required

Security Scanning

Automated Scanners

Scanner Trigger Scope
CodeQL Push/PR to main, weekly GitHub Actions
Zizmor Push/PR to main, weekly Workflow security

Vulnerability Sources

We collaborate with the Erlang Ecosystem Foundation CNA for BEAM ecosystem CVEs.

Vulnerability Response

Severity Response
Critical / High Out-of-band release
Medium / Low Normal update cycle

Vulnerability Handling

Secure Coding Practices

Input Validation

Boundary Validation
API endpoints Parameter validation
Package uploads Format and size validation
User input Sanitization before storage

Database Security

Practice Implementation
Parameterized queries Ecto (no raw SQL)
Connection pooling Postgrex with TLS
Schema validation Ecto changesets

Authentication

Feature Implementation
Password hashing bcrypt
TOTP 2FA pot library
OAuth2 ueberauth + GitHub
Session management Phoenix sessions

Related Documentation