# Security at The Orchard

This is an index to security documentation. From here you should be able to find links to all the security documentation. There is more underway, and it should be constantly growing and evolving. 

That said, if you have documentation you would like to add, improve, update or delete, make a PR and notify the \#tech-steering Slack channel! The more contributors and updates, the better.

## Infrastructure, Networking, and AWS

TBD

## Application Security

* [SonarQube Quick Start](https://docs.google.com/document/d/1kuOOc84ftSDD-r2Y3u6i77Ux8Ufrgjrk8BZrVwUmZzw/edit)
* [Team Security Processes](https://docs.google.com/document/d/1ASsGy_u52J3KgOYqlz3EwOVcYTBlbS_O2_CpWxczbkI/edit)
* [Risk Assessment for Orchard Project - in progress](https://docs.google.com/document/d/17RhjfUgN9g3yyTcGweJTjnlLdgVXLDjU1B9dBT3yxuo/edit#)
* [Github Vulnerabilities](https://docs.google.com/spreadsheets/d/1_IsnSF7IgjpwYSwUBlv2140KUZJIb2FgfV6zxreKTus/edit#gid=890352271)

## Security Audits

To help our projects prepare for SME InfoSec, and also to help make them and us more aware of security considerations around a project, we have started performing security audits on our projects. The audits along with some comments on risk assessment and threat profiling are available in [this google folder](https://drive.google.com/drive/folders/1SzUzUz1JMcdTrpdxvh1edViYv_5d7NdF?usp=sharing)

## JWT Documents

This is not an exhaustive collection of our JWT documents and plans, please feel free to add any you are aware of.
We have gathered them into a folder in the Information and Data Security team drive, called JWT docs, and [available here](https://drive.google.com/drive/folders/1-nOwq4Mg22Sy86GEBggG5KA6y5sGm_DF?usp=sharing)

## AppSec Demos and Donuts

* [AppSec Overview 2020-05-07](https://docs.google.com/presentation/d/1FSRFDBDpi_cVS4NzUW4IobyCN8soL3OwNNtBWeHBRE8/edit#slide=id.g847072ba3c_0_229)
* [Security Program and Roadmap 2020-09-03](https://docs.google.com/presentation/d/1kgD3MNYHt9_T5uZ5jQItyez2UFLtIWQxT66OIoCEE3Q/edit#slide=id.g92ef49ebb2_0_345)
* [OWASP API Top Ten 2020-12-10](https://docs.google.com/presentation/d/172i-Y2XOobkBlNKwI0ExSBA3Ba9hQqA3IV2ioidH8L0/edit#slide=id.gaebe3c4eda_0_301)