get all custom TTS systems added to Bug Bounty

[afeld]

Background Information

We should audit our list of systems against what's included in the Bug Bounty scope and see what should be added, as we made it an ATO requirement.

Implementation Steps

• [x] audit our list of systems against [what's included in the Bug Bounty scope]
• [x] see what should be added, as we made it an ATO requirement
• [ ] Communicate with GSA IT Security about this
• [ ] Prepare TTS Outreach to make an announcement
• [x] Get the thumbs up from each of the system owners
• [ ] Federalist policy has been reviewed
• [x] List of Federalist sites has been acquired
• [x] Gap analysis of Federalist sites and sites listed on HackerOne
• [x] Set up conversation with Federalist AO to talk about the Federalist relationship and Bug Bounty program
• [ ] Review Federalist? checklist
• [ ] Make recommendations to change/update Federalist procedures to getting into the Bug Bounty (if necessary)

Acceptance Criteria

• [ ] All custom TTS systems have bene added to the Bug Bounty

[its-a-lisa-at-work]

Completed audit

What needs to be added: Only listed in the scope table and needs to be added to above section:

• usa.gov
• tock

Should be listed outside of usa.gov and not within:

• analytics.usa.gov
• search.usa.gov

Not listed in the scope table:

• static.data.gov
• *.search.usa.gov

Systems that are live and should be considered to be added:

• coe.gsa.gov
• designsystem.digital.gov
• digital.gov
• pif.gov
• plainlanguage.gov

[its-a-lisa-at-work]

@afeld so, is this overcome by recent events now?

[afeld]

Maybe. The larger goal is to reduce costs of the FCSF. If adding more sites wouldn't increase the cost (not sure how we decided on the cost split), then this could continue. Agree that's a more important thing to figure out first.

[its-a-lisa-at-work]

roger; I think we need to figure out the cost first and then revisit this; going to move to Blocked/Watching and create a new issue to tackle the budget

[its-a-lisa-at-work]

Added a section in the Bug Bounty Options to include the Federalist sites into the program

[its-a-lisa-at-work]

Posted a message in the Bug Bounty channel to get clarity on this

[its-a-lisa-at-work]

Modifying the scope to this to add the Federalist sites; those are only sites/repos that we have that aren't in the Bug Bounty scope. There are a few systems 'under development' so those will get added down the line; the main outlier is the USWDS but that will get discussed in https://github.com/18F/tts-tech-portfolio/issues/1085

got the 👍🏼 from Federalist to smartly add in the sites; so working with H1 on the language now

[afeld]

Focusing on https://github.com/18F/tts-tech-portfolio/issues/1224 instead.