3. Developer guide

Prev: 2. User guide

Next: (none)

Pages:

3.1. Overview of the code
3.2. How to contribute
3.3. Code conventions
3.4. Code policies
3.5. Build processes
3.6. Running the server
3.7. Running and creating tests
3.8. Database
3.9. Storage interface
3.10. User interface
3.11. Tasks
3.12. Authentication security
3.13. Sessions
3.14. Authorization security
3.15. Input validation
3.16. Dependency updates
3.17. TLS security configuration
3.18. API documentation policy
3.19. ASF modules
3.20. Resource management
3.21. SBOM architecture

Sections:

Introduction
Security documentation

Introduction

This is a guide for developers of ATR, explaining how to make changes to the ATR source code. For more information about how to contribute those changes back to us, please read the contribution guide.

Security documentation

ATR is security-critical infrastructure for the Apache Software Foundation. Before contributing, you should familiarize yourself with our security practices:

Authentication security - How users authenticate to ATR via ASF OAuth and API tokens
Authorization security - The role-based access control model and LDAP integration
Input validation - Data validation patterns and injection prevention

For reporting security vulnerabilities, see SECURITY.md in the repository root.