Add topic about best practices for writing secure code

[TravisEz13]

Prerequisites

• Existing Issue: Search the existing issues for this repository. If there is an issue that fits your needs do not file a new one. Subscribe, react, or comment on that issue instead.
• Descriptive Title: Write the title for this issue as a short synopsis. If possible, provide context. For example, "Document new Get-Foo cmdlet" instead of "New cmdlet."

PowerShell Version

7.4

Summary

We have two scenarios:

1. Writing secure code in general
   2. Don't rely on auto-loading
   3. Import the modules you use or use module qualified invocation
2. Writing code for Constrained Language Mode

Details

No response

Proposed Content Type

About Topic

Proposed Title

No response

Related Articles

• https://devblogs.microsoft.com/powershell/powershell-security-best-practices/
• https://learn.microsoft.com/en-us/mem/configmgr/apps/deploy-use/learn-script-security

[sdwheeler]

Travis Plunk (@TravisEz13) Do you have a draft you can share?

[sdwheeler]

We have some existing documentation:

• PowerShell security features
• Using Windows Defender Application Control
• Preventing script injection attacks

[rakeshranderia]

I’d be interested in taking this issue on.

I think the useful gap is practical secure PowerShell authoring guidance rather than duplicating the existing PowerShell security features, application control, and script-injection documentation.

I’ve drafted an outline covering:

• trusted dependencies and predictable command resolution
• input validation
• avoiding dynamic code execution
• credentials and secret handling
• least privilege
• execution policy, application control and Constrained Language Mode
• external files and commands
• explicit failure handling and safe logging
• code signing
• dependency review and static analysis

I’d propose placing it under PowerShell > Security, alongside the existing security guidance.

If that scope and location make sense, I’m happy to submit an initial article as a PR.