# Security

Here are few hints and requirements regarding the security in La Suite's projects.

## GitHub

* [ ] Commit signing is mandatory, preferably using an external component (e.g., Yubikey);
* [ ] As a repository administrator, you must enforce 2FA for all members with repository rights;
* [ ] As a non-administrator repository user, you must enable 2FA on your account;
* [ ] Deploy manually to production: do not perform automatic deployments to production from the code repository (GitHub);

## Developer

* [ ] Use a password manager for all secrets, do not write your passwords in plain text (on paper, or even in a file); If this is not possible, you must split the information across multiple channels.
* [ ] Choose long passwords (at least 20 characters), complex and unique for each service;
* [ ] Create one account per person and avoid sharing accounts;
* [ ] Encrypt your storage devices;
* [ ] Use non-versioned environment variables, different between local, staging, and production;
* [ ] Develop in a containerized environment to protect the development machine from malicious dependencies;
