Members

• Diego Comas, Security Engineering Manager
  • André Eleuterio, Security Engineer
  • Mohammad Umer Alam, Security Engineer
  • Dora Neumeier, Compliance Manager
  • Vincent Ruijter, Security Engineer
  • Will Dollman, Security Engineer
  • Shivasurya Sankarapandian, Security Engineer

Contact

We’re here to help so reach out to us at security@sourcegraph.com with any questions you may have. Sourcegraph employees can reach us in the #security Slack channel or tag us using @sourcegraph/security on GitHub or @sourcegraph/security-code-review for a code review.

Security questions and support requests should be raised in #security:

1. Click the lightning bolt below the Slack message box in #security
2. Select an option at the top of the menu
3. Fill out the questions
4. Tag @security-support in the resulting thread if urgent

Security Ambassador Program

In an effort to work closely with our teammates and shift security focus more into the development process, we are pleased to introduce the Security Ambassador program which will align each one of our security engineers with an engineering organization.

• What does this mean?

  • The ambassador assigned to your organization will become very knowledgable on your team’s work.
  • The ambassador will help you integrate security thought-processes into your workflow.
  • The ambassador will become your primary point of contact regarding any security concerns that may arise in your development process.
  • The ambassador will be available to join any planning, testing and implementation meetings where their input might be beneficial.

• Why?

  • This will allow you to get quicker responses to your security questions and concerns from someone who has a deeper understanding of your team’s work.
  • This will allow us to produce a more secure product by integrating security into the early stages of product development.

• Does this mean I can’t talk to anyone else on the security team?

  • Absolutely not. You are welcome to reach out to anyone in the security team at anytime. We encourage everyone to use the #discuss-security slack channel.

• Who is the ambassador for my team?

Interviews

Interviews for candidates looking to join the Security team broadly follow the standard interview process, with two security-specific technical interviews. The nature of the technical interview will depend on the depth of your prior security experience.

For early career security engineers, there will be two case-study based technical interviews. The case studies will look at different areas of your security-based knowledge in the context of real-world examples that you might encounter during your time at Sourcegraph.

Experienced security engineers will have one resume-based technical deep dive, which will cover prior experience in the security field, and how this experience might be relevant to Sourcegraph. The second technical interview is an application security walkthrough, where candidates will walk us through a code example of their choice and discuss how they would review it from a security perspective.

If you are unsure about which interview set you will be doing, reach out to the recruiter you are working with for more information!

Onboarding

• New members onboarding guide

Security infrastructure and tooling

See tooling for a list of active tools we use and infrastructure for more information on the infrastructure that we maintain.

Responsibilities

• Proactively improve the security of our application and infrastructure. Includes continuous code reviews
• Define, plan, and prioritize security work that needs to be done (and then go do that work).
• Directly contribute to our codebase (i.e., Go, TypeScript, Kubernetes, Docker, Google Cloud Platform) to secure our application and deployments, and help other engineers on our team make the necessary changes.
• Respond to security vulnerability reports
  • https://github.com/sourcegraph/security-issues
• Increase our security posture by running traditional security tools such as vulnerability scanners, SAST, and DAST tools.
  • Security tooling
• Create a culture of security at Sourcegraph that empowers all of our engineers to write secure code.
• Respond to Security Incidents as per our Security Incident Response Policy

More detailed description of our responsibilities and what we do, can be found here.

Security Policies

We are responsible for maintaining company-wide security policies. You can find them here.

Secure coding guidelines

The secure coding guidelines contain information on how to address and prevent certain types of vulnerabilities. It’s a required read for engineers at Sourcegraph and is finished by completing a short assessment. The training and guidelines can be found here.

RFC reviews

Security should be added as an approver to the RFC if it:

• Proposes changing handling of customer data
• Proposes updates or new infrastructure
• Proposes accepting risk instead of other tradeoffs

We would much rather take a look at RFCs we didn’t need to than miss important RFCs. When in doubt, definitely ask us for a review.

Data Sharing

Please read about our data sharing practises and guidelines here.