diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 104b95e..841cc5d 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -6,7 +6,7 @@ Fixes # (issue) ## Type of Change -- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] Bugfix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Documentation update @@ -26,3 +26,13 @@ Please describe the tests that you ran to verify your changes. Provide instructi - [ ] I have made corresponding changes to the documentation - [ ] My changes generate no new warnings - [ ] I have checked my code and corrected any misspellings + +## Guides and Examples + +Only applies when this PR adds, renames, or moves a guide under `examples/`. + +- [ ] **Back-reference exists.** The internal knowledge-base chapter this guide came from links to it. Publishing a guide without the link back means nobody internal ever finds it β€” this is how guides end up orphaned. +- [ ] **Registered in `examples.json`,** so the `awesome-nan` catalog picks it up. +- [ ] **Links resolve.** Every relative link in the guide points at a file that exists on this branch. Renaming or moving a companion file silently breaks links from other guides and from the knowledge base. +- [ ] **Sanitized.** No client names, internal URLs, workspace identifiers, credentials, or PII. Placeholders (`-123`, `[git-host]`) instead of real internal values. +- [ ] **No unsafe examples.** Snippets do not print, log, or commit secrets, even as illustration. A copy-pasteable bad example is worse than no example. diff --git a/examples/the-ultimate-guide-to-secrets-management-for-developers/README.md b/examples/the-ultimate-guide-to-secrets-management-for-developers/README.md index 7cb9da6..7647697 100644 --- a/examples/the-ultimate-guide-to-secrets-management-for-developers/README.md +++ b/examples/the-ultimate-guide-to-secrets-management-for-developers/README.md @@ -14,7 +14,6 @@ Hello, Developer Friend! Welcome to your exciting journey into the _mystical lan - [Avoiding `.env` for Sensitive Data](#avoiding-env-for-sensitive-data) - [Secure Alternatives](#secure-alternatives) - [Using `direnv` for Local Development](#using-direnv-for-local-development) - - [Using `direnv` for Local Development](#using-direnv-for-local-development-1) - [Managing Different Stages with `direnv`](#managing-different-stages-with-direnv) - [Using `teller` for a Unified Approach](#using-teller-for-a-unified-approach) - [Using SDKs for Dynamic Retrieval](#using-sdks-for-dynamic-retrieval) @@ -68,19 +67,6 @@ export SUPER_STRONG_AND_COMPLICATED_PASSWORD=$(aws ssm get-parameter --name "SUP πŸ“ To set this up, you'll need `direnv` and `aws-cli` armed and ready. The official scrolls for `direnv` are here: [Direnv Documentation](https://direnv.net/docs/installation.html). -#### Using `direnv` for Local Development - -`direnv` is like your trusty sidekick that whispers secrets to you and only you when you enter your castle (or project directory). - -Instead of writing down your secrets, `direnv` can fetch them from AWS Parameter Store on the fly: - -```shell -# .envrc example -export SUPER_STRONG_AND_COMPLICATED_PASSWORD=$(aws ssm get-parameter --name "SUPER_STRONG_AND_COMPLICATED_PASSWORD" --with-decryption --query "Parameter.Value" --output text) -``` - -πŸ“ To set this up, you'll need `direnv` and `aws-cli` armed and ready. The official scrolls for `direnv` are here: [Direnv Documentation](https://direnv.net/docs/installation.html). - ##### Managing Different Stages with `direnv` If you’re a wizard of multiple realms (stages like `dev`, `staging`, `prod`), `direnv` can still be your arcane tool. Here's a spell to conjure the right environment based on your current stage: @@ -199,11 +185,21 @@ const getSecret = async () => { return Parameter.Value; }; -getSecret().then((password) => { - console.log("Secret Password:", password); +// Hand the secret straight to the client that needs it, and let it go out of +// scope. Never log it, never return it in an API response, never write it to disk. +const password = await getSecret(); + +const db = await createPool({ + host: process.env.DB_HOST, + user: process.env.DB_USER, + password, }); ``` +> ⚠️ **Never print a secret.** `console.log(password)` looks harmless in a snippet, but in a real service that value lands in stdout, CI job logs, container logs and whatever aggregator ships them (CloudWatch, Datadog, Splunk). +> +> Those are all places your secret should never be, and all places with far broader read access than your secrets store. If you need to confirm retrieval worked, log the parameter _name_ or a boolean, never the value. + πŸ“š To learn this magic, visit the grand library here: [AWS SDK for JavaScript](https://docs.aws.amazon.com/sdk-for-javascript/index.html). ## Conclusion diff --git a/examples/the-ultimate-guide-to-security-assessment-tools/README.md b/examples/the-ultimate-guide-to-security-assessment-tools/README.md index d7850c1..d728242 100644 --- a/examples/the-ultimate-guide-to-security-assessment-tools/README.md +++ b/examples/the-ultimate-guide-to-security-assessment-tools/README.md @@ -45,6 +45,12 @@ Performing regular scans helps in maintaining a secure codebase by identifying v Check out the [Code Scanning](CODE_SCANNING.md) guide for more details. +### Shift-Left Security πŸ‘ͺ + +The principle behind everything else in this guide: move detection as close to the moment code is written as possible, because a finding costs less the earlier it surfaces. + +Read the [Shift-Left Security](SHIFT_LEFT_SECURITY.md) guide for the reasoning and the rollout order. + ### Early Stages of Development Workflows πŸš€ - **IDE Integrations**: Learn how to integrate security tools with popular IDEs like VS Code and JetBrains. @@ -74,7 +80,7 @@ Learn how to integrate security tools into your GitLab in this [guide](CONTINUOU Integrating security scans in [AWS CodePipeline](https://docs.aws.amazon.com/codepipeline/). -Learn how to set up security scans in AWS CodePipeline in this [guide](CONTINUOUS_INTEGRATION_WITH_AWS.md). +Learn how to set up security scans in AWS CodePipeline in this [guide](CONTINUOUS_INTEGRATION_WITH_AWS_CODE_PIPELINE.md). Using these CI/CD tools ensures that every change is tested and validated for security issues before being merged and deployed.