The Integrity Of The Orbit Codebase

Using a code-signing scheme

5 min read · Tagged
  • security
  • technology
Anders Ingemann, Operations Manager & Developer
Published March 16, 2021

Discovering malicious changes

The integrity of the Orbit codebase is first and foremost verified through git, which disallows any rewriting of versioning history without explicit consent. This means that any malicious changes to the codebase must be applied on top of the current history, making the likelihood of a reviewer discovering the change almost a certainty.

The signing procedure

Orbit Online is using a code-signing scheme where every change is cryptographically signed with a key that resides on a physical YubiKey. This ensures a form of 2FA since said key is impossible to read from the YubiKey. Instead, the YubiKey itself performs the signing procedure.

Read more about Orbit Security Mechanisms & Procedures

Data encryption policy

User access to Orbit

Manage permissions in Orbit

Integration of external services

Personnel access to Orbit

Handling Security Exploits & Incidents

Isolation of components

Orbit Online A/S
Åbogade 25A
8200 Århus N
+45 7734 4539

CVR: 30 80 09 82