Skip to content

feat: add control OSPS-BR-07 for secrets management #373

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
funnelfiasco merged 4 commits into from
Sep 15, 2025
Merged

feat: add control OSPS-BR-07 for secrets management #373

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
57b5fe5
feat: add control OSPS-QA-08 for secrets management
trumant Aug 13, 2025
2d30186
Update OSPS-BR.yaml
trumant Sep 5, 2025
52d170a
Update OSPS-BR.yaml
trumant Sep 5, 2025
bd026c0
chore: resequence controls
trumant Sep 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions baseline/OSPS-BR.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -465,3 +465,36 @@ controls:
signature or attestations, such as GPG or PGP signature, Sigstore
signatures, SLSA provenance, or SLSA VSAs. Include the cryptographic
hashes of each asset in a signed manifest or metadata file.
- id: OSPS-BR-07
title: |
The project MUST store and manage all secrets and credentials used by the project in a secure manner.
objective: |
Ensure that sensitive data is not disclosed, compromised or misused leading to security vulnerabilities or supply chain compromise.
guideline-mappings:
- reference-id: BPB
identifiers:
- S-B-5 # TODO: is this the right numbering for https://www.bestpractices.dev/en/criteria#0.no_leaked_credentials
- reference-id: SSDF
identifiers:
- PO.1.1
- P0.3.1
- P0.4.2
- PO.5.1
- PW.1.2
- PW.1.3
- PW.5.1
assessment-requirements:
- id: OSPS-BR-07.01
text: |
The project MUST prevent the unintentional storage of unencrypted sensitive data, such as secrets and credentials, in the version control system.
applicability:
- Maturity Level 1
recommendation: |
Configure .gitignore or equivalent to exclude files that may contain sensitive information. Use pre-commit hooks and automated scanning tools to detect and prevent the inclusion of sensitive data in commits.
- id: OSPS-BR-07.02
Comment thread
trumant marked this conversation as resolved.
text: |
The project MUST define a policy for managing secrets and credentials used by the project. The policy should include guidelines for storing, accessing, and rotating secrets and credentials.
applicability:
- Maturity Level 3
recommendation: |
Document how secrets and credentials are managed and used within the project. This should include details on how secrets are stored (e.g., using a secrets management tool), how access is controlled, and how secrets are rotated or updated. Ensure that sensitive information is not hard-coded in the source code or stored in version control systems.

@evankanderson evankanderson Sep 5, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thinking about the removal of audit guidance from BR-07.01 (which I agree with), I wonder whether we should say something here about "credentials where are suspected to have been compromised or leaked should be rotated promptly".

That may be too much detail, but I'm playing back the previous conversations, and I'm wondering if I lost some good in an attempt to broaden accessibility.

Loading