Checks
35 articles
- Ensure all workspace members have two-factor authentication enabled
- Ensure two-factor authentication is enforced for the workspace
- Ensure former employees are removed from the workspace
- Ensure all workspace members use approved company email domains
- Ensure the number of workspace Admins is limited
- Ensure login is restricted to SSO or company Google accounts
- Ensure production environments are protected
- Ensure production environments block cross-environment traffic
- Ensure production secrets are scoped to production environments
- Ensure render.yaml changes to protected environments require code review
- Ensure internal applications are not deployed as public web services
- Ensure web services auto-deploy only from a protected branch
- Ensure pull request previews are disabled for sensitive services
- Ensure image-based services pull from an approved registry
- Ensure static site build variables contain no secrets
- Ensure static sites set security response headers
- Ensure static site redirects only point to approved domains
- Ensure production private services are in a network-isolated environment
- Ensure background workers use environment groups for secrets
- Ensure Docker-based cron jobs use a pinned image version
- Ensure workflows do not run in HIPAA-enabled workspaces
- Ensure workflows build from a protected branch
- Ensure Postgres databases are not accessible from the entire internet
- Ensure production Postgres databases do not use the Free plan
- Ensure production Postgres databases are in a protected environment
- Ensure Postgres databases run a supported major version
- Ensure internal Postgres connections require TLS
- Ensure Key Value instances require authentication for internal connections
- Ensure Key Value external access is restricted
- Ensure production Key Value instances have persistence enabled
- Ensure production Key Value instances are in a protected environment
- Ensure secrets are not stored in plaintext in render.yaml or code
- Ensure workspace audit logs are exported and retained for at least one year
- Ensure service logs are streamed to a central logging system
- Ensure DNS records do not point to removed Render custom domains