Apiiro Scanning

[robmoffat]

CVEs + Responsible Disclosure - https://community.finos.org/docs/governance/Software-Projects/cve-responsible-disclosure

• [ ] PRs get scanned for new CVEs, across direct and transitive dependencies; it must be able to include/exclude libraries, and ignore test dependencies. PRs should fail, if a new CVE is introduced.
• [ ] CVEs get proactively notified to (selected) team members, when codebase uses the vunerable library
• [ ] CVE notifications happen via email - no public data about security
• [ ] team member permissions inherited by GitHub repo permissions (may conflict with req. #3, as github users dont expose emails; maybe via a GitHub PAT)
• [ ] FINOS Staff can access an overall report across all projects and repositories, identify buckets of vulnerabilities and engage with the team

Static Code Checking (SAST)

• [x] Checking for vulnerabilities, access keys and passwords, hostnames and other sensitive data; establish workflows to fail/warn PRs

Opportunities

• [ ] Scan GitHub repository configuration and raise alerts: branch protection, permissions, secrets, security settings

[abhishek-sinha-db]

Any change needed for this @robmoffat

[robmoffat]

Should have assigned it to me - I'm already looking at this. Hopefully it will be better than whitesource, which is really hard to set up. I'll walk you through it when I get it working, it's pretty cool

[robmoffat]

doesn't work properly - closing

[robmoffat]

see #359