External Module (EM) Security Review

Custom EM Requirements

Researchers submitting a request to install a Custom EM must include the following for inspection, review and testing:

1. The Checklist for EM Development and
2. The URL for the Github repository.

Each custom EM submitted to REDCap must comply with the Packaging and Documentation criteria described in the Checklist for EM Development.

Submission of modified or re-purposed Custom EMs

Often a custom EM designed for a specific study is extended or modified for use on another study. Any such modules will be treated as new submissions. Provide an explanation that identifies the previous EM and what extensions and modifications were made in the submitted EM. This will expedite the code review and testing.

Note: If the EM can be generalized, consider developing it into a global EM to be shared on the Vanderbilt site.

Custom EM Requirements

Code review guidelines are listed under the Coding Practices and Security sections of the Checklist for EM Development. EM developers must provide clear and compelling justifications for any deviations from these standard practices.

Static Code Review

A static code review will be performed on each submitted EM. If this review identifies any critical coding errors, or code that is problematic from the security or data integrity standpoints, the EM will be returned for revision and resubmission.

Manual Code Review

A manual code review will be performed on EMs that have passed the static code review. This analysis will focus on deviations from the criteria listed under Coding Practices in the Checklist for EM Development. If insufficient justification is provided for any deviations, additional code review may be required which will incur fees.

Dynamic Code Review

Dynamic application code review on REDCap production hosts is periodically performed by the Yale Information Security Office (ISO). Yale ISO also continuously monitors the REDCap@Yale production servers for suspicious activity. If ISO reports implicate any EM, it will be immediately disabled, and the development team notified to resolve issues.

Global and Custom EM Requirements

We can provide you with access to our testing installation to safely test your work. Setting up an installation and testing may take several weeks depending on the complexity and performance of the EM. Please plan accordingly when building your development and implementation timeline.  

When testing, the module must be able to be enabled to function normally without any fatal PHP or JavaScript errors occurring.

Functionality Testing

The module’s functionality will be configured and tested according to its documentation. The module must be able to complete its functionality and not interfere with REDCap’s functionality, including the functionality of EMs that have been vetted and installed by REDCap@Yale.

Impact Testing

Testing will also make sure that data from projects using the External Module are not erased or become inaccessible when the External Module is disabled and removed from the system. Functionality will be checked again after re-installing the module and the data should still be accessible after re-installation.

EMs will be evaluated for undue load on the REDCap host. You may be asked to provide documented scalability tests on simulated data.

Security Planning Assessment

All Custom EMs must submit and clear a Security Planning Assessment (SPA) performed by Yale’s Information Security Office.  

Global and Custom EM Requirements

EM installation, enabling and disabling will be performed by the REDCap team. EM developers should indicate the permissions required for project-level EM configuration (i.e. restricted to project designers or by user role).

Global and Custom EM Requirements

The EM submission should include the anticipated end of EM support. For custom EMs this is often associated with a study phase such as the end of recruitment or follow-up.

At the approach of the designated date, the REDCap@Yale team will contact the EM developer to confirm that the EM should be disabled, or if an extension is required. If the EM is associated with a specific project, it will be disabled when the project is archived.