Establish Security Measures

[JamieBort]

Establish Security Measures

See Digital Knowledge Base for more info on this topic.

Also, there may be some untapped documentation for features other than Dependabot in the Address these dependabot alerts Trello card found in the #29 Issue.

Options

GitHub Security Measures

See the Options section of the Git security/ directory. That list is also listed below:

• Private vulnerability reporting
  Default setting is disabled.
  Based on my findings I am not going to change this feature.

• Dependency graph
  It is enabled and cannot be changed.

• Dependabot

  • Dependabot alerts
    The default setting is enabled with 1 rule
    The name of the rule is Dismiss low-impact alerts for development-scoped dependencies.
    I do not see any reason to add rules or change this one.
    I am not going to change that setting at this time.

  • Dependabot security updates
    The default is enabled
    I am not going to change this setting.

  • Grouped security updates
    The default is disabled.
    I enabled it.

  • Dependabot version updates
    The default is disabled.
    I NEED TO MAKE A DECISION about whether to enable it now, later, or possibly never.
    I enabled it. With a caveat. See the Status section of that Issue below.

• Code scanning

  • CodeQL analysis
    The default is disabled.
    I enabled it.

  • Other tools
    There is an option to Explore workflows.
    I do not see any reason to add this feature at this time.
    I will not do that at this time.

  • Check runs failure threshold
    The default setting is High or higher / Only errors.
    I do not see any reason to add this feature at this time.
    I will not do that at this time.

• Secret Scanning
  The default is disabled.
  I enabled it.

  • Push protection
    The default is disabled.
    I enabled it.

Other Security Measure options

There are others options that I am not going to look into right now.

Todo

• Make a list of any others. Add them below.
• Address this Your master branch isn't protected GitHub message #30
• Enable Dependabot Version Updates #29
• Before closing out this Establish Security Measures #35 Issue, review the No Status column of this Personal Dashboard project (view)
  Pull Issues relevant to this milestone into the ToDo column. Then address them accordingly.

[JamieBort]

All tasks in this Issue have been addressed.