Skip to content

Add topic about best practices for writing secure code #10099

Open

Description

Prerequisites

  • Existing Issue: Search the existing issues for this repository. If there is an issue that fits your needs do not file a new one. Subscribe, react, or comment on that issue instead.
  • Descriptive Title: Write the title for this issue as a short synopsis. If possible, provide context. For example, "Document new Get-Foo cmdlet" instead of "New cmdlet."

PowerShell Version

7.4

Summary

We have two scenarios:

  1. Writing secure code in general
    2. Don't rely on auto-loading
    3. Import the modules you use or use module qualified invocation
  2. Writing code for Constrained Language Mode

Details

No response

Proposed Content Type

About Topic

Proposed Title

No response

Related Articles

Activity

  1. sdwheeler commented on May 26, 2023

    @sdwheeler
    Contributor

    Travis Plunk (@TravisEz13) Do you have a draft you can share?

  2. sdwheeler commented on Jun 2, 2023

    @sdwheeler
    Contributor
  3. added a commit that references this issue on Nov 2, 2025
    a6e093e
  4. rakeshranderia commented on Sep 16, 2026

    @rakeshranderia

    I’d be interested in taking this issue on.

    I think the useful gap is practical secure PowerShell authoring guidance rather than duplicating the existing PowerShell security features, application control, and script-injection documentation.

    I’ve drafted an outline covering:

    • trusted dependencies and predictable command resolution
    • input validation
    • avoiding dynamic code execution
    • credentials and secret handling
    • least privilege
    • execution policy, application control and Constrained Language Mode
    • external files and commands
    • explicit failure handling and safe logging
    • code signing
    • dependency review and static analysis

    I’d propose placing it under PowerShell > Security, alongside the existing security guidance.

    If that scope and location make sense, I’m happy to submit an initial article as a PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-conceptualArea - Conceptual articlesarea-securityArea - Security module and conceptsissue-doc-ideaIssue - request for new contentup-for-grabsTag - issue is open for any contributor to resolve

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions