Security Best Practices

Security is paramount when automating development environment setup. This guide covers essential security practices for using DevEx safely and securely.

Security Warning: Always review scripts before executing them with elevated privileges. Never blindly run commands from untrusted sources.

Installation Security

Script Review Guidelines

Before running any installation script, including DevEx's installer:

Download and Inspect First

Always download scripts for review before execution:

# Download the installer script for review
curl -fsSL https://devex.sh/install -o devex-install.sh

# Review the script contents
less devex-install.sh

# Check for suspicious patterns
grep -E "(sudo|curl|wget|rm|chmod)" devex-install.sh

Verify Script Integrity

Check the script's authenticity and integrity:

# Verify the script hasn't been tampered with
curl -fsSL https://devex.sh/install.sha256 -o install.sha256
sha256sum -c install.sha256

# Check HTTPS certificate
curl -I https://devex.sh/install

Execute with Caution

Only execute after thorough review:

# Make executable and run
chmod +x devex-install.sh
./devex-install.sh

# Or pipe directly (only after verification)
curl -fsSL https://devex.sh/install | bash

Red Flags to Watch For

Dangerous Patterns - Never run scripts that contain:

Unconditional sudo rm -rf commands
Downloads from non-HTTPS sources
Execution of additional remote scripts without user consent
Modification of system-critical files without backup
Disabled security features (SELinux, firewalls)
Hardcoded credentials or API keys

DevEx Installation Verification

DevEx's official installer is designed with security in mind:

# Verify installer source and integrity
curl -I https://devex.sh/install
# Should return 200 OK with valid HTTPS certificate

# Check installer signature (when available)
curl -fsSL https://devex.sh/install.sig -o install.sig
curl -fsSL https://devex.sh/install -o install.sh
gpg --verify install.sig install.sh

Configuration Security

Safe Configuration Practices

Principle of Least Privilege

Only install applications you actually need

Version Pinning

Pin specific versions for reproducibility

Input Validation

Validate all configuration inputs

Backup First

Always backup before making changes

Secure Configuration Examples

Pin Specific Versions:

# ✅ Good: Pin specific versions
applications:
  development:
    - name: node
      version: "20.11.0"  # Pin to specific LTS version
      description: "Node.js JavaScript runtime"
      
    - name: docker
      version: "24.0.7"   # Pin to known stable version
      description: "Container platform"

# ❌ Bad: Using 'latest' versions
applications:
  development:
    - name: node
      version: "latest"   # Unpredictable, potential security risk

Validate Input Sources:

# ✅ Good: Use trusted, official sources
applications:
  development:
    - name: vscode
      linux:
        install_method: apt
        repository: "https://packages.microsoft.com/repos/code"
        key_url: "https://packages.microsoft.com/keys/microsoft.asc"

# ❌ Bad: Untrusted or unknown sources
applications:
  development:
    - name: some-tool
      linux:
        install_method: curlpipe
        install_command: "http://random-site.com/install.sh"  # HTTP, untrusted

Configuration Validation

Always validate configurations before applying:

# Validate configuration syntax and security
devex config validate

# Check for security issues in configuration
devex config security-check

# Preview changes before applying
devex install --dry-run

# Review specific application installation
devex install docker --dry-run --verbose

System Permissions

Understanding Permission Requirements

DevEx requires different permission levels for different operations:

No elevated privileges required:

Reading configuration files
Validating configurations
Listing available applications
Checking installation status
Using --dry-run mode

# Safe operations (no sudo needed)
devex --version
devex config validate
devex install --dry-run
devex list --available

Permission Best Practices

Permission Guidelines:

Start with dry-run - Always preview changes first
Use minimal permissions - Don't use sudo unless required
Review sudo operations - Understand what requires elevation
User-space first - Prefer user-space installations when possible
Backup before system changes - Create restore points

# ✅ Good: Minimal permission approach
devex install --dry-run                    # Preview first
devex install --user-space node python     # User-space when possible
sudo devex install docker                  # System-level only when needed

# ❌ Bad: Unnecessary elevation
sudo devex config validate                 # No sudo needed
sudo devex --version                       # No sudo needed

Network Security

Secure Download Practices

Verify HTTPS and Certificates:

# ✅ Good: Verify HTTPS connection
curl -fsSL https://devex.sh/install | bash

# ❌ Bad: Insecure HTTP connection
curl -fsSL http://devex.sh/install | bash  # Missing HTTPS

# ✅ Good: Verify certificate explicitly
curl --cacert /etc/ssl/certs/ca-certificates.crt https://devex.sh/install

Use Checksums for Verification:

# Download and verify integrity
wget https://github.com/jameswlane/devex/releases/download/v1.0.0/devex_linux_amd64.tar.gz
wget https://github.com/jameswlane/devex/releases/download/v1.0.0/checksums.txt

# Verify checksum
sha256sum -c checksums.txt

Proxy and Firewall Configuration

For corporate environments:

# Configure proxy for DevEx
export HTTPS_PROXY=https://proxy.company.com:8080
export HTTP_PROXY=http://proxy.company.com:8080

# Verify proxy configuration
devex config test-network

# Configure DevEx to use proxy
devex config set network.proxy "https://proxy.company.com:8080"

Secret Management

Handling Sensitive Data

Never Store Secrets in Configuration Files

DevEx configuration files should never contain:

API keys or tokens
Passwords or passphrases
Private keys or certificates
Database connection strings with credentials

Use Environment Variables:

# ✅ Good: Reference environment variables
system:
  git:
    username: "${GIT_USERNAME}"
    email: "${GIT_EMAIL}"
  
  ssh:
    key_path: "${HOME}/.ssh/id_rsa"

# ❌ Bad: Hardcoded secrets
system:
  api:
    key: "sk-1234567890abcdef"  # Never do this!

Secure Secret Storage:

# Use system keyring for secrets
secret-tool store --label="DevEx API Key" application devex key api

# Retrieve secrets securely
export DEVEX_API_KEY=$(secret-tool lookup application devex key api)

# Use with DevEx
devex install --api-key="${DEVEX_API_KEY}"

Incident Response

Security Monitoring

Monitor DevEx operations for security issues:

# Check DevEx audit logs
devex logs --security

# Review installed applications
devex list --installed --detailed

# Check for unauthorized changes
devex status --security-check

# Verify system integrity
devex system verify

Incident Response Plan

Immediate Response

If you suspect a security incident:

# Stop all DevEx operations
devex stop --all

# Disconnect from network (if necessary)
sudo ip link set down eth0

# Preserve evidence
devex logs export --security > security-incident-$(date +%Y%m%d-%H%M%S).log

Investigation

Investigate the scope of the incident:

# Check recent installations
devex list --installed --since="24 hours ago"

# Review configuration changes
devex config history --security-sensitive

# Check system modifications
devex system changes --since="24 hours ago"

Recovery

Clean up and restore system:

# Remove suspicious applications
devex uninstall suspicious-app

# Restore from backup
devex config restore --backup-id="pre-incident"

# Update and patch
devex update --security-patches

Security Compliance

Enterprise Security Standards

For organizations with security requirements:

SOC 2 Compliance:

# Example security-hardened configuration
security:
  audit_logging: true
  require_signatures: true
  allowed_sources:
    - "https://packages.microsoft.com"
    - "https://download.docker.com"
    - "https://github.com/jameswlane/devex"
  
  prohibited_patterns:
    - "curl.*http://"  # Block HTTP downloads
    - "rm -rf /"       # Block dangerous commands
    - "chmod 777"      # Block overly permissive permissions

GDPR Compliance:

# Data privacy controls
devex config set privacy.telemetry false
devex config set privacy.crash_reporting false
devex config set privacy.analytics false

# Data export for compliance
devex data export --user-data-only

Security Auditing

Regular security audits:

# Weekly security check
devex security audit --comprehensive

# Vulnerability scanning
devex security scan --installed-packages

# Configuration compliance check
devex config compliance --standard=SOC2

Community Security

Reporting Security Issues

If you discover security vulnerabilities:

Security Contact:

Email: security@devex.sh
PGP Key: Available at https://devex.sh/.well-known/security.txt
Response Time: Within 72 hours
Disclosure: Coordinated disclosure process

Security Updates

Stay informed about security updates:

# Subscribe to security notifications
devex security subscribe

# Check for security updates
devex update --security-only

# Enable automatic security updates
devex config set auto_update.security true

Security Checklist

Before deploying DevEx in production:

Security is Shared Responsibility: DevEx provides secure defaults and tools, but proper security requires ongoing vigilance and adherence to best practices by all users.

Installation Guide

Secure installation procedures

Configuration

Safe configuration practices

Troubleshooting

Security-related issue resolution

CLI Reference

Security-focused command options

Security Best Practices

Security Best PracticesCopy Anchor Link

Installation SecurityCopy Anchor Link

Script Review GuidelinesCopy Anchor Link

Download and Inspect FirstCopy Anchor Link

Verify Script IntegrityCopy Anchor Link

Execute with CautionCopy Anchor Link

Red Flags to Watch ForCopy Anchor Link

DevEx Installation VerificationCopy Anchor Link

Configuration SecurityCopy Anchor Link

Safe Configuration PracticesCopy Anchor Link

Principle of Least Privilege

Version Pinning

Input Validation

Backup First

Secure Configuration ExamplesCopy Anchor Link

Configuration ValidationCopy Anchor Link

System PermissionsCopy Anchor Link

Understanding Permission RequirementsCopy Anchor Link

Permission Best PracticesCopy Anchor Link

Network SecurityCopy Anchor Link

Secure Download PracticesCopy Anchor Link

Proxy and Firewall ConfigurationCopy Anchor Link

Secret ManagementCopy Anchor Link

Handling Sensitive DataCopy Anchor Link

Incident ResponseCopy Anchor Link

Security MonitoringCopy Anchor Link

Incident Response PlanCopy Anchor Link

Immediate ResponseCopy Anchor Link

InvestigationCopy Anchor Link

RecoveryCopy Anchor Link

Security ComplianceCopy Anchor Link

Enterprise Security StandardsCopy Anchor Link

Security AuditingCopy Anchor Link

Community SecurityCopy Anchor Link

Reporting Security IssuesCopy Anchor Link

Security UpdatesCopy Anchor Link

Security ChecklistCopy Anchor Link

Related DocumentationCopy Anchor Link

Installation Guide

Configuration

Troubleshooting

CLI Reference

On this page

Security Best Practices

Installation Security

Script Review Guidelines

Download and Inspect First

Verify Script Integrity

Execute with Caution

Red Flags to Watch For

DevEx Installation Verification

Configuration Security

Safe Configuration Practices

Secure Configuration Examples

Configuration Validation

System Permissions

Understanding Permission Requirements

Permission Best Practices

Network Security

Secure Download Practices

Proxy and Firewall Configuration

Secret Management

Handling Sensitive Data

Incident Response

Security Monitoring

Incident Response Plan

Immediate Response

Investigation

Recovery

Security Compliance

Enterprise Security Standards

Security Auditing

Community Security

Reporting Security Issues

Security Updates

Security Checklist

Related Documentation