Security labeled issues in Infrastructure
Issue triage
GitLab Security Bot opens up issues directly in production-engineering
so it skips some of the default labels that get applied. In some cases, these can fall through the cracks.
All security issues per tracker
- production engineering (37) https://gitlab.com/gitlab-com/gl-infra/production-engineering/-/issues/?sort=updated_desc&state=opened&label_name%5B%5D=security&first_page_size=100
- scalability (8) https://gitlab.com/gitlab-com/gl-infra/scalability/-/issues/?sort=updated_desc&state=opened&label_name%5B%5D=security&first_page_size=100
- delivery (8) https://gitlab.com/gitlab-com/gl-infra/delivery/-/issues/?sort=updated_desc&state=opened&label_name%5B%5D=security&first_page_size=100
Gitlab Security Bot issues
These issues are being opened but going unnoticed for the most part (a lot of domain takeovers). We should come up with something immediately to address it, maybe an automatic team assignment?
SLOs
Certain classes of issues have SLOs for response, which help us be sure we are keeping up with high priority tasks. They are the following:
-
corrective action based on https://handbook.gitlab.com/handbook/engineering/infrastructure/engineering-productivity/issue-triage/#severity-slos
- s1: 7 days
- s2: 30 days
- s3: 60 days
- s4: 90 days
-
IncidentReview we set a guideline of 2 weeks, documented here https://handbook.gitlab.com/handbook/engineering/infrastructure/incident-review/#incident-review-process
- Completed in 14 days
If we miss these SLOs the author will be pinged and the issue will get a SLOMissed or SLONear Miss label.
security issues SLOs are mentioned here https://handbook.gitlab.com/handbook/engineering/infrastructure/platforms/project-management/#corrective-actions-and-security-issues on the project management page but that link appears to be broken.
The best reference we have for security issues are https://handbook.gitlab.com/handbook/security/product-security/vulnerability-management/#remediation-slas which are:
- s1: 30 days
- s2: 30 days
- s3: 90 days
- s4: 180 days
I am initiating this after seeing this issue https://gitlab.com/gitlab-com/gl-infra/production-engineering/-/issues/25497 fall through the cracks a bit.