Mainnet Wallet production checklist

vgrichina commented 4 years ago

We need to prepare

[x] Error reporting (using Sentry)
[ ] Make sure all private data is scrubbed (ideally client-side) when reporting errors
[x] Use separate Render account and config for production
[ ] Make sure only limited set of people can access production account/config (GitHub stable, prod-ops, Render, DNS)
[x] Use protected stable branch for deploy (only limited set of people can merge)
[x] Use protected stable branch for deploy of near-contract-helper
[ ] Make sure that deploy uses only plain Unix tools (i.e. JS bundle, etc should be part of the repo)
[ ] Make sure JS bundle in repo is easily diffable between different stable releases (including dependency updates)
[ ] CI needs to verify that bundle committed in repo matches what is built from source
[x] Install Mixpanel via npm/or local copy
[x] Remove Google Analytics
[x] Make sure there are no scripts loaded from third-party domains (including stuff like Google Fonts)
[x] Make sure there is no third-party CSS loaded
[ ] Route sensitive links through URL fragment to avoid hitting server
[x] Make sure to scrub data sent to Mixpanel, especially URL.
[x] Make sure to scrub Twilio logs (removing through API for now, might use special data scrubbing feature).
[ ] Make sure to scrub SendGrid logs (looks like scrubbed already by them?)
[ ] Consider using Strict-Transport-Security https://www.netsparker.com/blog/web-security/http-strict-transport-security-hsts/

vgrichina commented 4 years ago

@kcole16 @ilblackdragon wonder if I'm missing anything. Note that it's not supposed to be checklist of all stuff we need for mainnet support, etc.

This is just in terms of how we'll run production wallet in terms of deploy, code review, etc

kcole16 commented 4 years ago

Think we should add the following either here or in another issue(s).

near / near-wallet