CNCF Security Best Practices

What it is

The reviewable specifics behind CNCF's "Security Guidelines for New Projects" — the concrete thresholds and fallbacks the summary lists only by category. The page is a checklist-style guide for securing a project's GitHub (or equivalent) source repository.

What to do

The page states specific, testable rules rather than generalities:

• Authentication tiers. Use password-protected SSH keys or a personal access token (PAT). Plain passwords are acceptable only for non-code-intensive projects that genuinely need browser access to GitHub.com and cannot use the recommended methods — and then only unique, complex ones.
• 2FA/MFA is required, not merely recommended, especially for privileged accounts.
• Review policy: every change goes through a pull request. The default bar is two independent reviewers, at least one with write access to the branch (preferably a maintainer), neither the requester. Explicit fallback: small teams may require a single reviewer. Large codebases should add a CODEOWNERS file to auto-request reviews.
• RBAC by least privilege, mapping GitHub's Owner/Maintainer/Developer/Reviewer/Approver/Guest roles to fine-grained permissions.
• Branch protection should be configured explicitly for: who can push, whether force-push is allowed, whether merges require checks, and whether branch deletion is permitted.

The five categories to work through are: securing code repositories, self-assessment, SECURITY.md, incident management, and badging.

Caveats

The guide states its own boundary: secure device management is assumed — "if you have a remote access trojan on your laptop, many of these countermeasures are subverted." The repository controls do not address endpoint compromise.

Scope is deliberately narrow: these are minimum measures aimed at sandbox / early-maturity projects, meant to be built on incrementally as maturity grows — not a complete security program. GitHub is used only as the reference SCM; the guidance is presented as portable to any source-control service. Tooling to implement these is deferred to the CNCF Cloud Native Security Map.

The two-reviewer rule is the one decision point worth flagging to your team:

flowchart TD
    PR[Pull request opened] --> Q{Team size?}
    Q -->|Small team| One[1 independent reviewer]
    Q -->|Normal| Two[2 independent reviewers,<br/>≥1 with write access]
    Q -->|Large codebase| CO[Add CODEOWNERS<br/>to auto-request review]
    One --> Merge
    Two --> Merge
    CO --> Two