# Outside a Config File: Security Settings

**URL:** <https://discuss.circleci.com/t/outside-a-config-file-security-settings/48622>\
**Category:** Self Service Configuration Review\
**Tags:** self-serve, config-review, manual\
**Created:** [July 11, 2023, 6:38pm UTC](https://discuss.circleci.com/t/outside-a-config-file-security-settings/48622 "2023-07-11T18:38:47Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![felixshiftellecon](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/felixshiftellecon/32/33360_2.png) [@felixshiftellecon](https://discuss.circleci.com/u/felixshiftellecon)\
**Post date:** [July 11, 2023, 6:38pm UTC](https://discuss.circleci.com/t/outside-a-config-file-security-settings/48622/1 "2023-07-11T18:38:47Z")

</div>

# Outside a Config File

## Security Settings

### Project Settings

Review [project](https://circleci.com/docs/glossary/#project) settings to ensure they are set correctly, this can be done via the UI or [API](https://fieldguide.circleci-labs.com/api_endpoints/project_settings_api/).

Confirm that the following Advanced settings are toggled _off_ unless needed for your use case:

- Build forked pull requests
- Pass secrets to builds from forked pull requests

Confirm that the following [API only project settings](https://fieldguide.circleci-labs.com/api_endpoints/project_settings_api/) are toggled _on_ unless not needed for your use case:

- disable-ssh
- write-settings-requires-admin

Confirm no unexpected SSH keys, project API tokens, or integrations are present.

### Org Settings

Confirm there are no unexpected technical or security contacts present. Add at least one if none are present.

Confirm [contexts](https://circleci.com/docs/contexts/) are restricted appropriately.

Ensure use of uncertified [orbs](https://circleci.com/docs/glossary/#orbs) is disabled if applicable.

* * *

> **▶ Next Step: [Outside the Config: Secret Management](https://discuss.circleci.com/t/outside-a-config-file-secrets-management/48623)**
> 
> **◀ Previous Step: [Inside the Config: Dynamic Configuration](https://discuss.circleci.com/t/dynamic-configuration/48620)**

> **📑 Table of Contents**
>
> [Self Service Configuration Review Overview](https://discuss.circleci.com/t/overview-self-service-configuration-review/48598)
> 
> 1. [Configuration Review Preparation](https://discuss.circleci.com/t/configuration-review-preparation/48607)
> - [Document the Config Review](https://discuss.circleci.com/t/document-the-config-review/48608)
> - [Review CircleCI Features](https://discuss.circleci.com/t/review-circleci-features/48609)
> - [Snapshot Project Metrics](https://discuss.circleci.com/t/snapshot-project-metrics/48610)
> 
> 2. [Review Each Job for Improvement Opportunities](https://discuss.circleci.com/t/review-each-job-for-improvement-opportunities/48611)
> - [General Job Opportunities](https://discuss.circleci.com/t/general-job-opportunities/48612)
> - [Execution Environment Opportunities](https://discuss.circleci.com/t/execution-environment-opportunities/48613)
> - [Opportunities for Jobs with High Duration](https://discuss.circleci.com/t/opportunities-for-jobs-with-high-duration/48614)
> 
> 3. [Review Each Workflow for Improvement Opportunities](https://discuss.circleci.com/t/review-each-workflow-for-improvement-opportunities/48615)
> 4. [High Level Improvement Opportunities](https://discuss.circleci.com/t/high-level-improvement-opportunities/48616)
> - [Inside the Config](https://discuss.circleci.com/t/high-level-improvement-opportunities/48616#inside-the-config-3)
> - [Config Security](https://discuss.circleci.com/t/config-security-opportunities/48618)
> - [Reusable Config](https://discuss.circleci.com/t/reusable-config-opportunities/48619)
> - [Dynamic Configuration](https://discuss.circleci.com/t/dynamic-configuration/48620)
> 
> - [Outside the Config](https://discuss.circleci.com/t/high-level-improvement-opportunities/48616#outside-the-config-4)
> - **[Security Settings](https://discuss.circleci.com/t/outside-a-config-file-security-settings/48622)**
> - [Secret Management](https://discuss.circleci.com/t/outside-a-config-file-secrets-management/48623)
> - [Storage Usage](https://discuss.circleci.com/t/outside-a-config-file-storage-usage/48624)
> - [Project Settings](https://discuss.circleci.com/t/outside-a-config-file-project-settings/48625)
> 
> 5. [Finalize Review](https://discuss.circleci.com/t/finalize-the-config-review/48626)