# Outside a Config File: Project Settings

**URL:** <https://discuss.circleci.com/t/outside-a-config-file-project-settings/48625>\
**Category:** Self Service Configuration Review\
**Tags:** self-serve, config-review, manual\
**Created:** [July 11, 2023, 6:46pm UTC](https://discuss.circleci.com/t/outside-a-config-file-project-settings/48625 "2023-07-11T18:46:04Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![felixshiftellecon](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/felixshiftellecon/32/33360_2.png) [@felixshiftellecon](https://discuss.circleci.com/u/felixshiftellecon)\
**Post date:** [July 11, 2023, 6:46pm UTC](https://discuss.circleci.com/t/outside-a-config-file-project-settings/48625/1 "2023-07-11T18:46:04Z")

</div>

# Outside a Config File

## Project Settings

### Security

Review [project](https://circleci.com/docs/glossary/#project) settings to ensure they are set correctly, this can be done via the UI or [API](https://fieldguide.circleci-labs.com/api_endpoints/project_settings_api/).

Confirm that the following Advanced settings are toggled _off_ unless needed for your use case:

- Build forked pull requests
- Pass secrets to builds from forked pull requests

Confirm that the following [API only project settings](https://fieldguide.circleci-labs.com/api_endpoints/project_settings_api/) are toggled _on_ unless not needed for your use case:

- disable-ssh
- write-settings-requires-admin

Confirm no unexpected SSH keys, project API tokens, or integrations are present.

### Non-security

Review project settings to see if any options would be helpful with your use case. Helpful options include:

- Only build pull requests
- Auto-cancel redundant [workflows](https://circleci.com/docs/glossary/#workflow)
- Enable dynamic config using setup workflows
- GitHub Status Updates

Review current triggers to ensure [scheduled pipelines](https://circleci.com/docs/scheduled-pipelines/) are running at the correct times. If there are no scheduled pipelines, consider implementing one.

Review available integrations and see if any can be implemented to improve user experience.

Review current [webhooks](https://circleci.com/docs/webhooks/) to ensure they are being consumed appropriately. If webhooks aren’t being used, consider implementing them.

* * *

> **▶ Next Step: [Finalize Review](https://discuss.circleci.com/t/finalize-the-config-review/48626)**
> 
> **◀ Previous Step: [Outside the Config: Storage Usage](https://discuss.circleci.com/t/outside-a-config-file-storage-usage/48624)**

> **📑 Table of Contents**
>
> [Self Service Configuration Review Overview](https://discuss.circleci.com/t/overview-self-service-configuration-review/48598)
> 
> 1. [Configuration Review Preparation](https://discuss.circleci.com/t/configuration-review-preparation/48607)
> - [Document the Config Review](https://discuss.circleci.com/t/document-the-config-review/48608)
> - [Review CircleCI Features](https://discuss.circleci.com/t/review-circleci-features/48609)
> - [Snapshot Project Metrics](https://discuss.circleci.com/t/snapshot-project-metrics/48610)
> 
> 2. [Review Each Job for Improvement Opportunities](https://discuss.circleci.com/t/review-each-job-for-improvement-opportunities/48611)
> - [General Job Opportunities](https://discuss.circleci.com/t/general-job-opportunities/48612)
> - [Execution Environment Opportunities](https://discuss.circleci.com/t/execution-environment-opportunities/48613)
> - [Opportunities for Jobs with High Duration](https://discuss.circleci.com/t/opportunities-for-jobs-with-high-duration/48614)
> 
> 3. [Review Each Workflow for Improvement Opportunities](https://discuss.circleci.com/t/review-each-workflow-for-improvement-opportunities/48615)
> 4. [High Level Improvement Opportunities](https://discuss.circleci.com/t/high-level-improvement-opportunities/48616)
> - [Inside the Config](https://discuss.circleci.com/t/high-level-improvement-opportunities/48616#inside-the-config-3)
> - [Config Security](https://discuss.circleci.com/t/config-security-opportunities/48618)
> - [Reusable Config](https://discuss.circleci.com/t/reusable-config-opportunities/48619)
> - [Dynamic Configuration](https://discuss.circleci.com/t/dynamic-configuration/48620)
> 
> - [Outside the Config](https://discuss.circleci.com/t/high-level-improvement-opportunities/48616#outside-the-config-4)
> - [Security Settings](https://discuss.circleci.com/t/outside-a-config-file-security-settings/48622)
> - [Secret Management](https://discuss.circleci.com/t/outside-a-config-file-secrets-management/48623)
> - [Storage Usage](https://discuss.circleci.com/t/outside-a-config-file-storage-usage/48624)
> - **[Project Settings](https://discuss.circleci.com/t/outside-a-config-file-project-settings/48625)**
> 
> 5. [Finalize Review](https://discuss.circleci.com/t/finalize-the-config-review/48626)