Secure Development and Change Management at CrowdHandler

CrowdHandler follows strict procedures for managing changes and implementing new features in a secure and compliant manner. Our modern policies include:

Secure Coding Practices

We adhere to OWASP guidelines and other secure coding best practices including:

  • Conducting static/dynamic code analysis to identify vulnerabilities
  • Developer training on common risks like XSS, injection, insecure configs, etc.
  • Keeping dependencies up to date to patch known CVEs
  • Storing sensitive data securely with restricted access
  • Conducting peer code reviews for all new features/changes
  • Using separate environments for development, testing, staging and production to isolate changes

Automated Testing and Continuous Integration

We utilize automated testing and CI/CD pipelines including:

  • Unit testing - Automated tests at the code level to validate functionality and handle edge cases.
  • Integration testing - Automated tests to verify interoperation between systems, APIs and components.
  • Deployment pipelines - Changes progress automatically through build, test and deployment stages. Pipelines halt at any stage where tests fail, requiring fixes before proceeding.
  • Canary testing - After deployment, a percentage of live traffic is diverted to the new version to monitor impacts before full rollout.

Change Management Procedures

Changes and new features follow a defined process:

  1. Documentation of requirements, risks and steps in a change record. Changes ranked by risk.
  2. Design review based on risk assessment and compliance requirements.
  3. Development in feature branches with peer code review and automated testing required to merge to main branch.
  4. Changes deploy to staging for UAT and final approval after tests pass.
  5. Deploying during approved window with messaging if any expected downtime. Validation required post-implementation.
  6. Maintaining an audit trail for all production changes.

CrowdHandler's policies minimize risks from software issues or poorly tested changes. Automation, testing, peer reviews, and traceability enhance the security and compliance of our application. Changes progress through environments and checks before deploying to production.