...
We do not insert USB devices or , SD cards etc. we do not trust.
Virus scanner
...
For all servers we implement a two-factor-authentication.
We only used well established providers (Heroku and AWS).
The servers are located in the EU.
We only offer an https interface to the clients.
We perform a regular vulnerability scan of the cloud service.
...
All our apps will undergo a static code analysis with the focus on security. For our open source apps we will use Coverity. Static code analysis is applicable for all new releases starting 2020-08-18We are using Snyk for this.
Dependency checks
The source code of all apps is hosted in Bitbucket. There we use the Snyk plugin to scan for vulnerabilities of dependencies. Vulnerabilities in dependencies will be fixed as soon as an update of the dependency is available (under the condition that the new dependency is still compatible with our app).
...