7. Developer guide

Up: Documentation

Prev: 6. Release catalog

Next: 7.1. Overview of the code

Pages:

• 7.1. Overview of the code
• 7.2. How to contribute
• 7.3. Code conventions
• 7.4. Code policies
• 7.5. Build processes
• 7.6. Running the server
• 7.7. Running and creating tests
• 7.8. Database
• 7.9. Storage interface
• 7.10. User interface
• 7.11. Tasks
• 7.12. Authentication security
• 7.13. Sessions
• 7.14. Authorization security
• 7.15. Input validation
• 7.16. Dependency updates
• 7.17. TLS security configuration
• 7.18. API documentation policy
• 7.19. ASF modules
• 7.20. Resource management
• 7.21. SBOM architecture
• 7.22. File handling

Sections:

• Introduction
• Security documentation

Introduction

This is a guide for developers of ATR, explaining how to make changes to the ATR source code. For more information about how to contribute those changes back to us, please read the contribution guide.

Security documentation

ATR is security-critical infrastructure for the Apache Software Foundation. Before contributing, you should familiarize yourself with our security practices:

• Authentication security - How users authenticate to ATR via ASF OAuth and API tokens
• Authorization security - The role-based access control model and LDAP integration
• Input validation - Data validation patterns and injection prevention
• File handling - Upload limits, archive validation and downloads

For reporting security vulnerabilities, see SECURITY.md in the repository root.