Caktus Security Policies and Practices

This project contains the security documentation for the security policies and best practices at Caktus Consulting Group. These policies include application development and deployment guidelines as well as instance response guidelines. This is a living set of policies which is actively updated as new threats are discovered and best practices shift.

• Application Development Considerations
  • Don’t Leave DEBUG on in Public
  • Check Your Redirect URLs
  • Don’t Perform Mutating Actions on GET Requests
  • Cache Leaking
• Server Configurations
  • User Access
  • Provisioning/Configuration
  • Application Secrets
  • Webserver Specifics
  • Developer Responsibility
• Dealing with Online Payments
  • Steps for Compliance
  • Common Mistakes
• Incident Response Guidelines for Developers
  • Sensitive Content Exposed to Unauthorized Persons
  • Website Credentials Exposed
  • Asset Credentials Exposed
  • Users Were Tricked by a Third Party with our Site
• How These Policies are Updated
  • Location of Current Standards
  • Communication of Updates
  • Recommending Policy Updates
  • Changelog