Discussion/Proposal: new requirement - no test-code in production environment.

[elarlang]

Spin-off from #880

#880 (comment)

New requirement like "Verify that production environment does not have test code.".
Language and grammar check and wordsmith needed.

[jmanico]

I think "Verify that production environment does not include test code" is ready for a PR.

[elarlang]

Category V14.1 "Configuration" > "Build"?

[jmanico]

I agree, good call! Let's do it!

[jmanico]

I'll keep an eye on this but would you care to drop the initial PR for this @elarlang ?

[elarlang]

What CWE I could use?

[elarlang]

Jim probably answered to another issue: #696 (comment)

[jmanico]

@elarlang I deleted on of your comments on accident but this is indeed back open, my bad.

[jmanico]

What CWE I could use?

I say 489

https://cwe.mitre.org/data/definitions/489.html (debug code in production)

or

https://cwe.mitre.org/data/definitions/215.html (sensitive data in debug code)

[elarlang]

Proposal:

• Label: [ADDED]
• Category: V14.1 Configuration > Build
• Id: 14.1.7
• Requirement: Verify that production environment does not include test code.
• Levels: 2, 3
• CWE-489

[jmanico]

I like it.