Application Security Runbooks

1. You are here:
2. Handbook
3. Security at GitLab
4. Security Engineering
5. Application Security
6. Application Security Runbooks

On this page

• Application Security Runbooks

Application Security Runbooks

Note for new joiners: whenever you are on a rotation (HackerOne or Triage Rotation) or doing your onboarding process and need help or advice, reach out in the #sec-appsec Slack channel or ask during an AppSec Sync meeting. Here are some examples on scenarios where you may need ask or need help: - You're doing your onboarding tasks on threat model or appsec reviews, and you're stuck on it, or don't know how to tackle something in particular - You're on ping rotation, and you don't know how to deal with a particular situation, or what to do with a specific question - You're on HackerOne rotation and have to deal with a hard report

• HackerOne Process
• Procedures for Handling severity::1/priority::1 Issues
• Security Engineer Process for both Regular and Critical Security Releases
• Verifying Security Fixes
• Security Dashboard Review
• Triage Rotation
• AppSec Review Template Process
• Threat Modeling
• Investigating Package Hunter Findings
• Release Certification Process
• JiHu Contribution Security Review Process
• AppSec Engineer's Local Setup
• Federal AppSec Container Scanning Review
• JiHu Contribution Merge Monitor Report Process
• Bug Hunting Day process
• Appsec Frequenty Asked Questions
• How to plan and measure engagement with Secure Code Warrior
• Holiday and Friends and Family day coverage
• Gem Review Guidelines for AppSec Engineers