Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces a new "AppSec Baseline" documentation page that establishes minimum security expectations for all development teams in Equinor. The baseline serves as a foundational reference point before teams dive into the more detailed AppSec Toolbox.
Changes:
- Added new baseline documentation outlining six core security expectations
- Updated navigation to include the baseline section between the main index and toolbox
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| docs/baseline/index.md | New documentation establishing minimum security expectations across "What we deliver" (threat modeling, GHAS alerts, application knowledge, governance) and "How we deliver" (Slack participation, knowledge sharing) |
| docs/.pages | Added baseline navigation entry to place it prominently in the site structure |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| - **What data does your application handle, and what is its classification?** | ||
| - **Who has access to your system and why?** | ||
| - **What are your dependencies and where are they running?** |
There was a problem hiding this comment.
I am thinking this is dependencies like downstream api's, but could be misunderstood as dependabot dependencies coming right after the GHAS section. One could rephrase to something like
What APIs and services does your application rely on, and where are they hosted?
|
|
||
| - The AppSec guidelines on [this site](../toolbox/index.md) - our practical take on how to implement secure development | ||
| - [OWASP](https://owasp.org/) and the relevant top 10 lists for your technology | ||
|
|
There was a problem hiding this comment.
Maybe add:
- "Where/who to contact when things has gone wrong" (Incident handling)
| You should be able to answer these questions about your application at any time: | ||
|
|
||
| - **What data does your application handle, and what is its classification?** | ||
| - **Who has access to your system and why?** |
There was a problem hiding this comment.
This is the OWASP top 10 broken access control reference, maybe we could add something around principle of least privilege or defense in depth for authorization
Who has access to your system, and do they have only the access they need?
No description provided.