Add secret scanning to SCM guide, fixes #488

[david-a-wheeler]

No description provided.

[david-a-wheeler]

@SecurityCRob - comments?

I did not try to edit best-practices.yml. I'm not sure what that yml file is doing. Is that the source & the README is generated? I don't see any code to do the generation. If the .yml file is generated from the README, then please run that tool. If they're edited simultaneously, well, yuck :-(. In any case, there should be a clear document somewhere what their relationship is.

[ctcpip]

this is great! looks good, just some minor corrections, and a few consistency suggestions as well

[SecurityCRob]

I like the addition. If we could get Chris' open comment resolved I think we can move this forward

[SecurityCRob]

@SecurityCRob - comments?

I did not try to edit best-practices.yml. I'm not sure what that yml file is doing. Is that the source & the README is generated? I don't see any code to do the generation. If the .yml file is generated from the README, then please run that tool. If they're edited simultaneously, well, yuck :-(. In any case, there should be a clear document somewhere what their relationship is.

I think Randall put that in place. I'm also unsure how that works. We should ask him to start.

[balteravishay]

@SecurityCRob - comments?
I did not try to edit best-practices.yml. I'm not sure what that yml file is doing. Is that the source & the README is generated? I don't see any code to do the generation. If the .yml file is generated from the README, then please run that tool. If they're edited simultaneously, well, yuck :-(. In any case, there should be a clear document somewhere what their relationship is.

I think Randall put that in place. I'm also unsure how that works. We should ask him to start.

I think that might relate to how the Legitify was used to produce these recommendations. maybe @noamd-legit can comment on this and suggest how to add new ones?

[noamd-legit]

The best-practices.yml is generated automatically and does not require manual edits. In fact, I believe we can remove it entirely from this repository.

To update the document, simply edit the markdown file. If we need to regenerate the base version, I will handle any differences that arise.

[david-a-wheeler]

In that case, I suggest removing the .yml file (in a separate pull request). We generally don't want generated files in the source repo.

@noamd-legit - would you mind creating that PR?

[noamd-legit]

@david-a-wheeler
Removed the file here: #508