Application Security Runbooks

1. You are here:
2. Handbook
3. Security at GitLab
4. Security Engineering
5. Application Security
6. Application Security Runbooks

On this page

• Application Security Runbooks
• Note for New team members

Application Security Runbooks

• HackerOne Process
• Procedures for Handling severity::1/priority::1 Issues
• Security Engineer Process for both Regular and Critical Security Releases
• Verifying Security Fixes
• Security Dashboard Review
• Triage Rotation
• AppSec Review Template Process
• Threat Modeling
• Investigating Package Hunter Findings
• Release Certification Process
• JiHu Contribution Security Review Process
• AppSec Engineer's Local Setup
• Federal AppSec Container Scanning Review
• JiHu Contribution Merge Monitor Report Process
• Bug Hunting Day process
• Appsec Frequenty Asked Questions
• How to plan and measure engagement with Secure Code Warrior
• Holiday and Friends and Family day coverage
• Gem Review Guidelines for AppSec Engineers
• FedRAMP vulnerabilities triage runbook and guidance
• How to handle upstream security patches?
• Working with SIRT

Note for New team members

Whenever you are on a rotation (HackerOne or Triage Rotation) or doing your onboarding process and need help or advice, reach out in the #sec-appsec Slack channel or ask during an AppSec Sync meeting. Here are some examples on scenarios where you may need ask or need help:

• You're doing your onboarding tasks, threat modeling, or appsec reviews, and you're stuck on it; or don't know how to tackle something in particular
• You're on ping rotation and you don't know how to deal with a particular situation or what to do with a specific question
• You're on HackerOne rotation and have to deal with a hard report