# Code\_Improvement Project ## Overview Purpose to improve code quality and security for the Mojaloop project. Includes analysis and introduction of new open sources tools, process improvments, gates checks (w/in pull requests and builds) along with documentation. Scope: project is focused on quality and security but can lead to other areas such as test automation and DevOps automation and tools. ## OutPut (phase one by end of January): * Implementation and analysis of new OSS tools * Update Release Scripts: Security aspects need to be embedded in release/devops (CI/CD) * Update rules for Pull Requests: Security aspects embedded in pull requests (before check-ins) * Update documentations: Standards and contribution guides Slack Channel:#code\_security ## Discussions: ### Implement changes at the Dockerfile and CI/CD build process to help bolster our container security * Create a non-root user within the Dockerfile * Enable docker-content-trust on the docker host (this will be inside CircleCI) * Run builds with --no-cache during CircleCI step to ensure that we are pulling in any new security patches each time (I don’t think this is a major issue since we don’t have CircleCI docker image caching on anyway ### Move from Javascript to Typescript * Transition to typescript (mix and match js and ts) for more security/quality * Typescript is preferred but not required: