PSIRT Runbooks

PSIRT Runbooks

This section contains operational runbooks for the Product Security Incident Response Team (PSIRT).

Critical Incident Response

• Handling priority::1/severity::1 Issues - Process for handling critical security incidents
• Working with SIRT - Guide for engaging and collaborating with SIRT

General Runbooks

• CVSS Calculation - Guide for calculating CVSS scores on GitLab security issues
• General process for the application security team in patch releases - Process for AppSec team involvement in security patch releases
• Handling unintended vulnerability disclosures - Runbook for handling different scenarios of unintended vulnerability disclosures
• HackerOne Process - Process for managing vulnerability reports through GitLab’s bug bounty program
• Holiday and Friends and Family Day Coverage - Process for PSIRT coverage during holidays and Friends and Family days
• How to handle upstream security patches - Process for handling security patches in upstream dependencies
• PSIRT Case Lifecycle - Description of how PSIRT manages vulnerability cases through their lifecycle
• Verifying Security Fixes - Process for validating and verifying security fixes

Note for Team Members

When you’re on-call or handling a security incident and need help or advice, reach out in the #security-department Slack channel or escalate according to the Security Engineer On-Call process.

View page source - Edit this page - please contribute.