microsoft / code-with-engineering-playbook

This is the playbook for "code-with" customer or partner engagements
https://microsoft.github.io/code-with-engineering-playbook/
Creative Commons Attribution 4.0 International
2.15k stars 568 forks source link

Add article on Azure DevOps service connection security #913

Closed BlueBasher closed 1 year ago

BlueBasher commented 1 year ago

Pull Request Template

What are you trying to address

This PR adds an article that describes a potential security issue in Azure DevOps and how to fix that issue.

Description of new changes

A new article has been added that describes a security issue that can be present in an Azure DevOps setup regarding Service Connections. The article describes what the actual issue is and how Service Connections should be configured to fix the issue.

For all pull requests

TessFerrandez commented 1 year ago

Thank you for the PR - generally I think the content is good, but I think perhaps it fits better in Continuous Delivery or Continuous Integration under dev-sec-ops -- there are some similar patterns in there. I think that might be where people would go to look for content of this nature... thoughts?

BlueBasher commented 1 year ago

Before creating the PR, I was in doubt whether it should be Security or Continuous Integration. But CI seems like a good fit indeed. I've moved the content and updated the PR.