4 min lectura • Guide 569 of 877
How to Use GitScrum for Security Development Projects?
How to use GitScrum for security development projects?
Manage security work in GitScrum with dedicated labels (security, vulnerability), private tasks for sensitive issues, and security review columns. Track vulnerability remediation, coordinate security reviews, and document security decisions in NoteVault. Teams with structured security tracking reduce vulnerability exposure by 60% [Source: Application Security Research 2024].
Security workflow:
- Identify issues - Vulnerability scan, report
- Create tasks - Security label
- Assess severity - CVSS or internal scale
- Prioritize - By severity + exposure
- Fix - Development workflow
- Verify - Security review
- Close - Document resolution
Security labels
| Label | Purpose |
|---|---|
| type-security | All security work |
| vulnerability | Known vulnerability |
| security-feature | Security improvement |
| security-review | Needs security sign-off |
| severity-critical | CVSS 9.0-10.0 |
| severity-high | CVSS 7.0-8.9 |
| severity-medium | CVSS 4.0-6.9 |
| severity-low | CVSS 0.1-3.9 |
Vulnerability task template
## Vulnerability: [CVE or description]
### Details
- Severity: [Critical/High/Medium/Low]
- CVSS: [score]
- Affected: [component]
- Discovered: [date]
- Deadline: [date based on severity]
### Remediation
- [ ] Identify fix
- [ ] Implement fix
- [ ] Security review
- [ ] Deploy
- [ ] Verify remediation
Severity SLAs
| Severity | Remediation SLA |
|---|---|
| Critical | 24-48 hours |
| High | 7 days |
| Medium | 30 days |
| Low | 90 days |
Security review column
| Feature Type | Requires Review |
|---|---|
| Authentication | Always |
| Authorization | Always |
| Payment | Always |
| Data handling | Personal/sensitive |
| External integration | Third-party access |
NoteVault security documentation
| Document | Content |
|---|---|
| Security policies | Team standards |
| Vulnerability log | Historical issues |
| Security checklist | Review criteria |
| Incident response | Procedures |
| Compliance | Requirements |
Column subscribers for security
| Column | Subscribers |
|---|---|
| Security Review | Security team |
| Vulnerability | Security lead |
| Critical issues | CTO, Security lead |
Security review checklist
| Check | Verify |
|---|---|
| Authentication | Proper auth checks |
| Authorization | Access control |
| Input validation | Sanitized inputs |
| Output encoding | XSS prevention |
| Secrets | No hardcoded secrets |
| Logging | No sensitive data |
| Dependencies | No known vulns |
Coordinating security work
| Scenario | Approach |
|---|---|
| Critical vuln | Drop everything |
| Planned security | Sprint allocation |
| Security debt | Budget 10-20% |
| Compliance | Dedicated sprint |
Private vs public tasks
| Type | Visibility |
|---|---|
| Active vulnerability | Private until fixed |
| Security feature | Normal visibility |
| Post-fix vulnerability | Document learnings |
| Policy | Normal visibility |
Security metrics
| Metric | Track |
|---|---|
| Open vulnerabilities | Count by severity |
| Time to fix | By severity |
| Security review pass rate | % first-time pass |
| Dependency vulnerabilities | Automated scan |
Common security issues
| Issue | Solution |
|---|---|
| Hidden vulns | Centralize tracking |
| Slow remediation | SLAs + escalation |
| Bypassed reviews | Required for sensitive |
| No documentation | NoteVault policies |