Updating BuildCheck threat model by security review feedbacks

dotnet / msbuild

The Microsoft Build Engine (MSBuild) is the build platform for .NET and Visual Studio.

https://docs.microsoft.com/visualstudio/msbuild/msbuild

MIT License

5.15k stars 1.34k forks source link

Updating BuildCheck threat model by security review feedbacks #10138

Closed rokonec closed 2 weeks ago

rokonec commented 2 weeks ago

Context

Addressed following feedback: Reword mention of component governance and SBOMs Adjust acquisition to be out of scope, rather than a mitigation Reserved rule name it a security feature, make it a reliability feature.

Testing

No code changes