Outside a Config File: Security Settings

[felixshiftellecon]

Outside a Config File

Security Settings

Project Settings

Review project settings to ensure they are set correctly, this can be done via the UI or API.

Confirm that the following Advanced settings are toggled off unless needed for your use case:

• Build forked pull requests
• Pass secrets to builds from forked pull requests

Confirm that the following API only project settings are toggled on unless not needed for your use case:

• disable-ssh
• write-settings-requires-admin

Confirm no unexpected SSH keys, project API tokens, or integrations are present.

Org Settings

Confirm there are no unexpected technical or security contacts present. Add at least one if none are present.

Confirm contexts are restricted appropriately.

Ensure use of uncertified orbs is disabled if applicable.

---

Next Step: Outside the Config: Secret Management

Previous Step: Inside the Config: Dynamic Configuration

📑 Table of Contents

Self Service Configuration Review Overview

1. Configuration Review Preparation
   • Document the Config Review
   • Review CircleCI Features
   • Snapshot Project Metrics
2. Review Each Job for Improvement Opportunities
   • General Job Opportunities
   • Execution Environment Opportunities
   • Opportunities for Jobs with High Duration
3. Review Each Workflow for Improvement Opportunities
4. High Level Improvement Opportunities
   • Inside the Config
     • Config Security
     • Reusable Config
     • Dynamic Configuration
   • Outside the Config
     • Security Settings
     • Secret Management
     • Storage Usage
     • Project Settings
5. Finalize Review