search

jupyter / security

BSD 3-Clause "New" or "Revised" License
19 stars 7 forks source link

Recommendations on CodeQL and other automated scanning? #15

Open krassowski opened 2 years ago

krassowski commented 2 years ago

I wonder if you have thoughts on setting up automated code scanning for code repositories. for example with CodeQL. Personally, it helped me catch some issues, but I know it can be noisy on larger projects (but those are few). Should Jupyter subprojects be encouraged to include such a job on CI (some already have)?

manics commented 2 years ago

In theory I think it's a good thing, in practice I think many of us aren't sure how to use CodeQL effectively e.g. see https://github.com/jupyterhub/binderhub/issues/1404

Perhaps recommending CodeQL along with the option of help from someone who can optimise the config, or provide advice on reducing noise, could be helpful? This inevitably leads to the question of who can provide that help, is it voluntary or paid, etc.... Perhaps a Jupyter Security Advocate (analogous to a developer/community advocate) position?