Security Overview

HOME » TECHNICAL DOCUMENTATION » SECURITY OVERVIEW

Frontend

Requirements

• All user input returned to the frontend is properly output encoded by default in React. There are no instances of dangerouslySetInnerHTML, which circumvents React’s default protections.
• Snyk vulnerability and dependency scanning runs on every PR to check for vulnerabilities in dependencies.
• Trufflehog secrets detection has been ran against the repository.

Out of Scope

• Denial of Service (DoS) Attack Vectors
• AuthN and AuthZ
• Session Hijacking
• Cross Site Request Forgery (CSRF)

Additional Thoughts

Security Headers: if the State hosts the Frontend, it is highly recommended that they review and implement all applicable security headers

• Content-Security-Policy
• Strict-Transport-Security
• X-Frame-Options
• X-Content-Type-Options
• X-Xss-Protection

Backend

A complete security review of the backend has not been completed.

If you are new to AWS here are a few articles on security best practices to read before implementing:

• General Best Practices
• Understanding the Root User
• Identity and Access Management (IAM) Security Best Practices
• Simple Storage Service (S3) Security Best Practices
• Lambda Security Best Practices