Add vulnerabilities/security scanning - Githubissues

frequenz-floss / frequenz-repo-config-python

Frequenz repository setup tools and common configuration for Python

https://frequenz-floss.github.io/frequenz-repo-config-python/

MIT License

4 stars 7 forks source link

Add vulnerabilities/security scanning #29

Open leandro-lucarella-frequenz opened 1 year ago

leandro-lucarella-frequenz commented 1 year ago

Some options:

bandit is a Python specific tool to find common security issues in Python code.
CodeQL is a more general GitHub specific solution that supports many languages.

Discussion:

https://github.com/frequenz-floss/frequenz-repo-config-python/discussions/28

llucax commented 7 months ago

New auto-fix feature for CodeQL:

https://github.blog/changelog/2024-03-01-codeql-2-16-3-ai-powered-autofixes-for-python-updated-queries-and-security-fixes/