Skip to content

Security

This document outlines the security model, practices, and recommendations for the Fawkes Internal Developer Platform (IDP).

Principles

  • Least Privilege: All components and users are granted only the permissions they need.
  • Separation of Duties: Infrastructure, platform, and application responsibilities are separated.
  • Defense in Depth: Multiple layers of security controls are implemented across the stack.
  • Transparency: All security controls and configurations are documented and open for review.

Secrets Management

  • Never commit secrets to version control.
  • Use secret management tools (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, or Kubernetes Secrets).
  • Store only encrypted secrets in infrastructure code; inject secrets at deploy time.
  • Add secret files and templates to .gitignore.

Automated Secret Detection:

  • Fawkes uses Gitleaks and detect-secrets in pre-commit hooks and CI/CD pipelines
  • Pipelines fail immediately if secrets are detected
  • See the Secrets Management Guide for detailed information

Identity and Access Management (IAM)

  • Use cloud-native IAM (AWS IAM, Azure AD, GCP IAM) for resource access control.
  • Use Kubernetes RBAC for fine-grained access within clusters.
  • Rotate credentials and keys regularly.
  • Use service accounts for automation and CI/CD, with minimal permissions.

Network Security

  • Deploy resources in private subnets where possible.
  • Restrict public ingress using security groups, firewalls, and Kubernetes network policies.
  • Use TLS/SSL for all service endpoints.
  • Enable logging and monitoring for network traffic.

Platform Security

  • Enable audit logging for all infrastructure and platform components.
  • Regularly update dependencies and base images to address vulnerabilities.
  • Use vulnerability scanning tools (e.g., Trivy, Gitleaks) in CI/CD pipelines.
  • Enforce code reviews and automated tests for all changes.

Kubernetes Security

  • Use namespaces to isolate workloads.
  • Apply Pod Security Standards (PSS) or PodSecurityPolicies.
  • Limit container privileges (no root, no privilege escalation).
  • Use network policies to restrict pod-to-pod communication.
  • Scan container images for vulnerabilities before deployment.

CI/CD Security

  • Store CI/CD credentials securely (never in code).
  • Use environment variables or secret stores for pipeline secrets.
  • Limit pipeline permissions to only required resources.
  • Scan code and dependencies for vulnerabilities on every build.
  • Automated secrets scanning with Gitleaks in every pipeline run

Monitoring and Incident Response

  • Enable and monitor audit logs for all cloud and platform resources.
  • Set up alerts for suspicious activity or failed authentication attempts.
  • Document incident response procedures and regularly review them.

User Responsibilities

  • Use strong, unique passwords and enable MFA where possible.
  • Report any suspected security issues to the project maintainers.
  • Follow the contributing guidelines for secure code contributions.

Reporting Vulnerabilities

If you discover a security vulnerability, please report it responsibly by opening a private issue or contacting the maintainers directly.

References