@@ -26,7 +26,7 @@ This Working Group has the following goals:
1. Successfully transition PVS to a long term owner
- The [Anti-abuse](/handbook/engineering/development/sec/software-supply-chain-security/anti-abuse/) group [owns and maintains PVS](https://about.gitlab.com/direction/software_supply_chain_security/#pvs-pipeline-validation-service)
- The [Abuse Engineering](/handbook/engineering/development/sec/security-platform/abuse-engineering/) group [owns and maintains PVS](https://about.gitlab.com/direction/software_supply_chain_security/#pvs-pipeline-validation-service)
This structure took effect with the FY27 Sec reorg, which replaced the Application Security
Testing, Security Risk Management, and Software Supply Chain Security stages. The stage
pages for those three are still being folded into the new stage pages.
## On-call
Sec runs a shared on-call rotation spanning Security Platform and Security Governance
teams. See the [Sec on-call handbook](oncall/).
It is important to delineate who the EM and PM DRIs are for every functionality, especially where this may not be obvious. This is documented on a dedicated [delineation page](delineate-sec.html).
@@ -41,9 +74,9 @@ The following resources provide guidance for common development patterns across
### Observability
-[Tutorial: Add observability metrics to a CI-based analyzer](/handbook/engineering/development/sec/secure/analyzer-observability-metrics/) -
-[Tutorial: Add observability metrics to a CI-based analyzer](/handbook/engineering/development/sec/security-factory/analyzer-observability-metrics/) -
Step-by-step guide for implementing the decentralized events pattern in security analyzers.
@@ -89,7 +89,7 @@ This includes all items assigned to Threat Insights under [Page/Function respons
These workflows are owned by Threat Insights as part of [Vulnerability Pages](https://docs.gitlab.com/ee/user/application_security/vulnerabilities/)(see above).
This includes integration into the monorepo, display in Vulnerability pages, the merge request interface for Vulnerability Resolution, and integration into Duo Chat for Vulnerability Explanation. Threat Insights collaborates with [AI Core Infra](/handbook/engineering/ai/ai-core-infra/) and [Duo Chat](/handbook/engineering/ai/duo-chat/) to support integration into areas these teams own.
Prompts, test data set curation, and verifying quality of responses for Vulnerability Explanation and Vulnerability Resolution are owned by the relevant groups in [Secure](/handbook/engineering/development/sec/secure/) based on the type of vulnerability. These groups communicate and collaborate with [Vulnerability Research](/handbook/engineering/development/sec/secure/vulnerability-research/) and [AI Core Infra](/handbook/engineering/ai/ai-core-infra/) for prompt engineering support, as needed. These features are currently available for [SAST](/handbook/engineering/development/sec/secure/#sast) only.
Prompts, test data set curation, and verifying quality of responses for Vulnerability Explanation and Vulnerability Resolution are owned by the relevant groups in [Secure](/handbook/engineering/development/sec/secure/) based on the type of vulnerability. These groups communicate and collaborate with [Threat Research](/handbook/engineering/development/sec/security-factory/threat-research/) and [AI Core Infra](/handbook/engineering/ai/ai-core-infra/) for prompt engineering support, as needed. These features are currently available for [SAST](/handbook/engineering/development/sec/secure/#sast) only.
While prompts are owned by teams in Secure, prompt engineering is an important part of software development at GitLab, the AI-Powered DevSecOps platform. Teams within Govern - including Threat Insights - are expected to onboard and be able to support prompt engineering for these features, and assist as needed with updating the prompts in the monorepo through follow the sun coverage.
