Secure-development governance policies missing

secure_dev_policies

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

low

Family

SCM

Description

Does the project publish the secure-development governance policies expected by SPVS V1.3?

SPVS V1.3.1–V1.3.5 require documented development-security policies — a secure-development policy, an open-source-usage policy, and a secrets-management policy. These are distinct from the vulnerability-disclosure SECURITY.md checked by the security_policy detector. This check looks for at least one recognised policy file under the project root, .github/, or docs/, and reports when none is present.

The set of recognised policy file names and the directories searched are both configurable. The check is intentionally lenient — a single recognised policy file clears it — because the goal is to confirm the governance artefacts exist and are discoverable, not to grade their content.

Security

Written, discoverable policies are what turn ad-hoc secure-development practices into a repeatable, auditable process: they tell contributors how to handle dependencies, secrets, and reviews, and they are the evidence an assessor looks for against SPVS V1.3.

Mitigation / Fix

Add the missing policy documents under the project root, .github/, or docs/ — for example SECURE_DEVELOPMENT.md, OSS_POLICY.md, and SECRETS_POLICY.md. Keep them short and link them from the README/CONTRIBUTING so contributors find them.

Configuration

To change these options you can modify SCANNER_DIR/conf/misconfigurations/secure_dev_policies.yml. The following are the default configuration properties:

properties:
  # Recognised secure-development / OSS / secrets policy file names.
  policyFiles:
    - SECURE_DEVELOPMENT.md
    - SECURE-DEVELOPMENT.md
    - SECURE_DEVELOPMENT_POLICY.md
    - DEVELOPMENT_POLICY.md
    - OSS_POLICY.md
    - OPEN_SOURCE_POLICY.md
    - SECRETS_POLICY.md
    - SECRET_MANAGEMENT.md
  # Directories searched for the policy files.
  directories:
    - '' # project root
    - .github
    - docs