Cryptographic APIs misuses

misterAnderson90 commented 2 years ago

I'm a PhD student interested in finding security vulnerabilities in open source projects.

We found a total of 7 warnings (indicating potential vulnerabilities) when running the CogniCrypt static analyzer (*) on open_money_tracker (or its library dependencies). We documented each one of these issues in private gists for the sake of confidentiality (non-disclosure).

Can you please let us know whether we can share these gists with you? We are eager to evaluate the perception of developers (e.g. severity of these warnings) and improve open_money_tracker's security, and the quality of the reports of static analysis tools. (*) https://github.com/CROSSINGTUD/CryptoAnalysis

yev-kanivets commented 2 years ago

Hey @misterAnderson90, we are certainly interested. You can share gists with me using yev@xorum.io email 🙏

misterAnderson90 commented 2 years ago

Hello @yev-kanivets,

I have shared with you the email with the reports. All of them are related to the third-party library dropbox-sdk-java

Could you please evaluate these warnings based on your perceptions?

xorum-io / open_money_tracker

Cryptographic APIs misuses #29