- Framework
- In progress
OWASP ASVS: Aligned
Self-assessed by IdeaScore. Not certified by an outside body.
Open standards for the security of web applications.
In place
- Request validation, upload size limits and rate limits on the routes people can reach without signing in.
- Production builds ship without source maps or development tools.
- Each release passes automated tests, including tests of our safeguards.
Work in progress
- A check of every Level 1 requirement against the app.
- An automated security scan of our test site with each release, with its report kept.
- A fix, or a written reason, for each finding.
Evidence
- Security test reports and their fixesOn request
Limits
- A scan that finds nothing proves little. We will publish what each scan found and how we fixed it.
Bring Your Questions to a Product Specialist
A 30-minute walkthrough of the Trust Centre, the Data and Privacy card and the Decision Trail, with your committee's questions.