7

I have a project that runs a website with a frontend SPA and REST API backend.

Currently the code is split into /client and /server folders and they run independently. However, they are currently in the same repository.

If I hire some contractors that will work only on the client side code, is there any security benefit to splitting this into two repositories and only giving the front end contractors the client side code to work on?

The developers will still be able to connect their local development environment to a dev environment running the server in the cloud.

The main concern I have is that the backend code might be sold on to hackers by an untrustworthy dev and then some security holes are gleaned by looking through our code.

1
  • I edited the title to hopefully fit the question better. If you disagree, please feel free to roll back to your previous version.
    – user163495
    Commented Feb 6, 2020 at 13:06

1 Answer 1

1

Yes, these should generally be split.

They might together form one solution, but the code itself is logically separate. As such, people with access to one repository don't necessarily need access to the other.

What are the risks?

Selling vulnerabilities to hackers is a possibility, but those hackers can also just find the same vulnerabilities in your code. A much greater risk is to sell the code itself to a competitor, or use it to build a competing product.

While I am not accusing you contractors of doing that - they may very well be honest people doing honest work - there have been reports of contractors doing exactly that. They spent their time analyzing your product, even having their questions answered by staff, and a year later came out with a competing product. While it could not be proven that they stole any code, it is too much of a coincidence to be a coincidence.

How to split the code?

Depending on your version control system being used, this may or may not be an easy task. If you use Git, for example, it's not as simple as just duplicating the repository and deleting one half of each. Git keeps all the old files in its history, so a contractor with access to a local copy of your "client-only" repository could still happily browse the server data up until the point of the split (which may be enough to be malicious). Newer contractors, who then check out the new "client-only" repository, would still be able to get access to the server data.

The "simplest" way would be to completely erase the old repository and re-build two repositories with their respective commit history. This can take anywhere between an hour and a decade of work, depending on how large the repository is.

There may be automated tools available, or you may be able to write your own script for that too. I was never in this situation, so I don't have any hands-on experience with it.

Of course, this would still leave the contractor with local copies of your old code, but this code must already be considered compromised if it ended up on their machines. But at least it would stop future contractors from getting access to it.

5
  • Thanks for your answer... why do the new repos need a commit history... they could be built with an initial commit of the current files no?
    – teaspoon
    Commented Feb 6, 2020 at 12:57
  • 1
    Yes, but it means you would lose every kind of version information, which can help immensely if you need to track down a bug (e.g. by using git-bisect)
    – user163495
    Commented Feb 6, 2020 at 12:59
  • Ok, thanks, never used git-bisect before or the history very much to track down bugs... will look into that.
    – teaspoon
    Commented Feb 6, 2020 at 13:02
  • @teaspoon The commit history becomes exponentially more valuable as your project grows. Especially for security-related issues it is sometimes vital to know when an issue was introduced to see which versions are affected.
    – user163495
    Commented Feb 6, 2020 at 13:05
  • Do you know if there is any way in git for me to keep the current combined repo as is, create a new client repo that contractors use, and then pull the changes that happen there into only the client folder of the current combined repo?
    – teaspoon
    Commented Feb 6, 2020 at 13:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .