Security#

What protects a Whoobe installation, what has been tested, and what is still open. Written for security officers, architects and reviewers.

Start with these#

Document	What it tells you
Threat model	What is protected, who may attack, the trust boundaries, the threats, the controls and the residual risks
Status summary	One page: where security work stands
Findings register	Every finding with its severity and whether it is open
Data protection	Personal data, where it is, who can receive it, retention, rights of the data subject
Design decisions	The security-relevant choices and their trade-offs

Controls in detail#

Area	Documents
Identity and access	Authentication and authorization; API clients for applications
Credentials and encryption	Encryption, secrets and keys, API Gateway security
Supply chain	Supply chain, dependencies and SBOM
Operations	Observability and logging, backup and DR

Evidence: tests#

Document	What it covers
Test suite summary	One page: what the automated suites do and their counts
Automated test suite	Every suite, what it asserts and does not
Testing plan	The phases of the security programme
Manual checklist	Checks that need a browser or a human eye
Security CI for forks	What you get when you fork, and how to keep it

Not available today (stated plainly in the overview, chapter 4): single sign-on for staff, a full audit trail of administrative actions, high availability, a third-party compliance certificate.