search

kjd / idna

Internationalized Domain Names for Python (IDNA 2008 and UTS #46)
BSD 3-Clause "New" or "Revised" License
247 stars 91 forks source link

Suggest adoption of Scorecard GitHub Action #150

Closed diogoteles08 closed 9 months ago

diogoteles08 commented 11 months ago

Hey, I'm Diogo and I've raised the issues #139 and #142 contributing with some security enhancements. I'll happily continue contributing with such improvements (it's literally my job, see my profile), but this time I come to suggest the tool that I used myself to find those security issues.

I'd like to suggest that the project add the OpenSSF Scorecard Action. The OpenSSF Scorecard uses GitHub's public API to gather public informations about your project and runs a sort of "meta-analysis" of the project's security posture. The installed action would populate the project's Security Panel with possible improvements to its security posture. It's specially helpful to ensure you won't regress on the security measures you have already adopted 😄.

Additionally, the tool integrates with the OSV Scanner, which evaluates a project's transitive dependencies looking for known vulnerabilities.

This tool is developed by the OpenSSF in partnership with GitHub and it's already been adopted by 1800+ projects, including Tensorflow, PyTorch, Angular, and Flutter.

If you're interested, let me know and I'll send a PR!

kjd commented 10 months ago

I don't see any problems with trying this out, if you'd like to send in a PR.