App security

How the software is changed, and how actions are recorded.

Code review
Status: In progress
Our process is that every code change goes through a pull request that the owner reviews before release. GitHub does not enforce this on the main branch yet; required reviews and passing checks are being turned on.
Automated checks
Status: In place
Every pull request runs tests, a secret scan and a dependency audit.
Dependency updates
Status: In place
Dependencies are checked for updates weekly.
No secrets in code
Status: In place
Passwords and keys are kept in Azure Key Vault, never in code.
Fails safely
Status: In place
If a key or permission is missing, the system refuses to run instead of guessing.
Audit
Status: In progress
Every sensitive action is logged. The log is being built so it cannot be edited after the fact.

Code review