openits

Repository on GitHEach user-facing release has a unique version identifier. Release v1.1.0 is published on GitHub with release notes and identifies a specific commit.

Key URLs:

• https://github.com/imRezaAlie/openits/releases/tag/v1.1.0
• https://github.com/imRezaAlie/openits/releasesub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The public GitHub repository contains the full development history, not only final release snapshots. Interim work is available for collaborative review via commits on main and develop, feature/hotfix branches, and merged pull requests. Tags (e.g. v/v1.1.0) mark releases but do not replace the ongoing commit history between releases.

Key URLs:

• https://github.com/imRezaAlie/openits/commits/main
• https://github.com/imRezaAlie/openits/tree/develop
• https://github.com/imRezaAlie/openits/branches

Repository on GitHub, which uses git. git is distributed.

Release v1.1.0 includes human-readable release notes summarizing major changes (documentation, security policy, lint tooling, and verification steps). The notes are organized by category and are not a raw git log output.

Key URL:

• https://github.com/imRezaAlie/openits/releases/tag/v1.1.0

Release v1.1.0 did not fix any publicly known run-time vulnerabilities that had a CVE (or similar) assignment at the time of release. The release notes document documentation, security policy, and development tooling changes only. Users can self-update by cloning/pulling the repository or upgrading to the tagged release.

Key URL:

• https://github.com/imRezaAlie/openits/releases/tag/v1.1.0

Users can report bugs via GitHub Issues using the English bug report template. The README documents the process, required information, and response policy. Security vulnerabilities are directed to private reporting via SECURITY.md instead of public issues.

Key URLs:

• https://github.com/imRezaAlie/openits/issues/new/choose
• https://github.com/imRezaAlie/openits/blob/main/.github/ISSUE_TEMPLATE/bug_report.md
• https://github.com/imRezaAlie/openits#bug-reports

The project uses GitHub Issues to track bugs, feature requests, and other work. English issue templates are provided for structured reports.

Key URLs:

• https://github.com/imRezaAlie/openits/issues
• https://github.com/imRezaAlie/openits/issues/new/choose

No public bug reports have been submitted via GitHub Issues in the last 2–12 months (open_issues_count: 0; only pull requests exist, no bug-labeled issues). The project documents an acknowledgment policy (within 5 business days) in README and CONTRIBUTING.md for future bug reports.

Key URLs:

• https://github.com/imRezaAlie/openits/issues
• https://github.com/imRezaAlie/openits#bug-reports
• https://github.com/imRezaAlie/openits/blob/main/CONTRIBUTING.md#response-policy

No public enhancement or feature requests have been submitted via GitHub Issues in the last 2–12 months (only pull requests exist; open_issues_count: 0). The project remains active with ongoing development, merged PRs, and release v1.1.0. A feature request template and response policy are documented for future requests.
Key URLs:

• https://github.com/imRezaAlie/openits/issues
• https://github.com/imRezaAlie/openits/blob/main/.github/ISSUE_TEMPLATE/feature_request.md
• https://github.com/imRezaAlie/openits/releases

GitHub Issues provides a public, searchable archive of all bug reports, feature requests, and maintainer responses. Closed issues remain visible for later search.

Key URL:

• https://github.com/imRezaAlie/openits/issues

SECURITY.md publishes the vulnerability reporting process: do not use public GitHub Issues; report privately by email or via GitHub Private Vulnerability Reporting, with required details and response timelines. README links to this policy.

Key URLs:

• https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#reporting-a-vulnerability
• https://github.com/imRezaAlie/openits/security/policy
• https://github.com/imRezaAlie/openits/security/advisories/new

Private vulnerability reporting is supported via email and GitHub Private Vulnerability Reporting (HTTPS). SECURITY.md instructs reporters not to use public GitHub Issues and explains how to submit reports privately.

Key URLs:

• https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#reporting-a-vulnerability
• https://github.com/imRezaAlie/openits/security/advisories/new

No vulnerability reports have been received in the last 6 months. SECURITY.md documents a target initial response within 48 hours for future reports.

Key URL:

• https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#response-timeline

OpenITS is rebuilt from source using Composer (PHP dependencies) and npm/Vite (frontend assets). After modifying source code, run composer install and npm install && npm run build, then php artisan migrate as needed. Build steps are documented in README.

Key URLs:

• https://github.com/imRezaAlie/openits#build--test
• https://github.com/imRezaAlie/openits/blob/main/composer.json
• https://github.com/imRezaAlie/openits/blob/main/package.json

The project uses standard, widely adopted build tools: Composer for PHP dependency management and autoloading, and npm with Vite for frontend asset compilation — the conventional stack for Laravel applications.

Key URLs:

• https://github.com/imRezaAlie/openits/blob/main/composer.json
• https://github.com/imRezaAlie/openits/blob/main/package.json
• https://github.com/imRezaAlie/openits#build--test

The project can be built entirely with FLOSS tools: PHP (open source), Composer (MIT), Node.js (open source), npm (open source), and Vite (MIT). No proprietary build tools are required.

Key URLs:

• https://github.com/imRezaAlie/openits/blob/main/composer.json
• https://github.com/imRezaAlie/openits/blob/main/package.json
• https://github.com/imRezaAlie/openits#build--test

The project includes a publicly released PHPUnit test suite (69 tests) under tests/, run via Laravel's test runner. PHPUnit is FLOSS. How to run tests is documented in README and CONTRIBUTING.md (composer test or php artisan test).

Key URLs:

• https://github.com/imRezaAlie/openits/tree/main/tests
• https://github.com/imRezaAlie/openits#build--test
• https://github.com/imRezaAlie/openits/blob/main/CONTRIBUTING.md#test-policy
• https://github.com/imRezaAlie/openits/blob/main/phpunit.xml

Tests are invoked using standard PHP/Laravel tooling: php artisan test (Laravel's built-in runner) or vendor/bin/phpunit directly. A Composer script (composer test) is also provided.

Key URLs:

• https://github.com/imRezaAlie/openits#build--test
• https://github.com/imRezaAlie/openits/blob/main/composer.json
• https://github.com/imRezaAlie/openits/blob/main/phpunit.xml

Tests are invoked using standard PHP/Laravel tooling: php artisan test (Laravel's built-in runner) or vendor/bin/phpunit directly. A Composer script (composer test) is also provided.

Key URLs:

• https://github.com/imRezaAlie/openits#build--test
• https://github.com/imRezaAlie/openits/blob/main/composer.json
• https://github.com/imRezaAlie/openits/blob/main/phpunit.xml

CONTRIBUTING.md defines a formal test policy: new major functionality must include automated tests (feature tests for HTTP endpoints, unit tests for services). README also references this policy in the Build & Test and Contributing sections.

Key URLs:

• https://github.com/imRezaAlie/openits/blob/main/CONTRIBUTING.md#test-policy
• https://github.com/imRezaAlie/openits#build--test

CONTRIBUTING.md defines a formal test policy: new major functionality must include automated tests (feature tests for HTTP endpoints, unit tests for services). README also references this policy in the Build & Test and Contributing sections.

Key URLs:

• https://github.com/imRezaAlie/openits/blob/main/CONTRIBUTING.md#test-policy
• https://github.com/imRezaAlie/openits#build--test

The test policy is documented in CONTRIBUTING.md, which is the project's change-proposal guide. It instructs contributors to add tests for new major functionality, describes where to place them, and includes a PR checklist item requiring tests for new features.

Key URLs:

• https://github.com/imRezaAlie/openits/blob/main/CONTRIBUTING.md#how-to-contribute
• https://github.com/imRezaAlie/openits/blob/main/CONTRIBUTING.md#test-policy
• https://github.com/imRezaAlie/openits/blob/main/CONTRIBUTING.md#pull-request-checklist

The project uses Laravel Pint (FLOSS, MIT) as a linter to enforce PSR-12 code style and catch common issues. Configuration is in pint.json; run via composer lint (check) or composer lint:fix (auto-fix). Documented in README and CONTRIBUTING.md.

Key URLs:

• https://github.com/imRezaAlie/openits/blob/main/pint.json
• https://github.com/imRezaAlie/openits/blob/main/composer.json
• https://github.com/imRezaAlie/openits#build--test

All linter warnings have been addressed. Laravel Pint (composer lint) passes cleanly with zero issues across 241 files. Style fixes were applied to the codebase; no outstanding warnings remain.

Key URLs:

• https://github.com/imRezaAlie/openits/blob/main/pint.json
• https://github.com/imRezaAlie/openits#build--test

For PHP, the project applies practical strictness where compiler-style warning flags are not available: Laravel Pint enforces PSR-12 across the entire codebase (composer lint passes on 241 files with zero issues), CONTRIBUTING.md requires lint before pull requests, and coding standards encourage declare(strict_types=1), typed properties, and return types on PHP 8.2+.

Key URLs:

• https://github.com/imRezaAlie/openits/blob/main/pint.json
• https://github.com/imRezaAlie/openits/blob/main/CONTRIBUTING.md#coding-standards
• https://github.com/imRezaAlie/openits#build--test

The primary developer and maintainer (Reza Alie) has designed OpenITS with secure-software practices, including bcrypt password hashing, login rate limiting, security headers, LDAPS/STARTTLS support, Sanctum token expiration, LDAP filter escaping, SSRF mitigation for admin LDAP tests, controlled user provisioning, and private vulnerability reporting (SECURITY.md). Security considerations are documented in README and aligned with common OWASP recommendations.

Key URLs:

• Maintainer Profile :https://www.linkedin.com/in/rezaalie/
• https://github.com/imRezaAlie/openits/blob/main/SECURITY.md
• https://github.com/imRezaAlie/openits#security
• https://github.com/imRezaAlie/openits/blob/main/app/Services/LoginThrottleService.php

The primary developer (Reza Ali) understands common vulnerability classes for web applications (per OWASP Top 10 / CWE/SANS) and has implemented mitigations in OpenITS:

Injection (SQL, LDAP): Eloquent ORM; LDAP filter escaping in LdapService Broken authentication: bcrypt passwords; LoginThrottleService; session regeneration Sensitive data exposure: SESSION_ENCRYPT; HTTPS/HSTS headers; LDAP passwords never stored Broken access control: is_admin middleware; auth on routes; C4 collaboration permissions

OpenITS uses only publicly published, expert-reviewed cryptographic protocols and algorithms via Laravel and PHP standard libraries — no custom cryptography. By default: bcrypt for password hashing (Hash facade, BCRYPT_ROUNDS=12), Laravel Sanctum for API tokens, AES-based session encryption when SESSION_ENCRYPT=true, TLS/HTTPS and LDAPS/STARTTLS for transport, and random_bytes()/Str::random() for secure random values. Documented in SECURITY.md.

Key URLs:
https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#cryptography-practices
https://github.com/imRezaAlie/openits/blob/main/config/hashing.php
https://github.com/imRezaAlie/openits/blob/main/.env.example

OpenITS is a web application, not a cryptography library. It delegates all cryptographic operations to established libraries: Laravel's Hash facade (bcrypt via PHP's password hashing), Laravel Sanctum for API tokens, Laravel session encryption, and PHP's random_bytes()/Str::random(). The project does not implement custom cryptographic algorithms.

Key URLs: https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#cryptography-practices https://github.com/imRezaAlie/openits/blob/main/app/Http/Controllers/Auth/RegisterController.php https://github.com/imRezaAlie/openits/blob/main/config/hashing.php

All cryptographic functionality in OpenITS is implemented with FLOSS: PHP (open source), Laravel framework (MIT), Laravel Sanctum (MIT), and bcrypt password hashing via PHP's built-in password API. No proprietary cryptographic libraries or closed-source crypto components are required.

Key URLs: https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#cryptography-practices https://github.com/imRezaAlie/openits/blob/main/composer.json https://github.com/imRezaAlie/openits/blob/main/config/hashing.php

OpenITS uses cryptographic key lengths that meet or exceed NIST 2030 minimums. Application encryption is fixed to AES-256-CBC (256-bit symmetric, above the 112-bit minimum) in config/app.php, with a 256-bit APP_KEY generated by php artisan key:generate. Password hashing uses bcrypt (covered separately under crypto_password_storage, not this criterion). API tokens use Laravel Sanctum (SHA-256 class hashing, above the 224-bit hash minimum). Transport security relies on TLS/HTTPS and LDAPS/STARTTLS, configured per README/SECURITY.md; LDAP_ALLOW_INSECURE=false disables cleartext LDAP. The application does not offer weaker cipher or key-length options in its configuration.

Key URLs: https://github.com/imRezaAlie/openits/blob/main/config/app.php https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#cryptography-practices https://github.com/imRezaAlie/openits#security

OpenITS does not use broken cryptographic algorithms by default. Password hashing uses bcrypt (Laravel Hash). Application encryption uses AES-256-CBC. API tokens use Laravel Sanctum. Random values use random_bytes()/Str::random(). Transport security uses TLS/HTTPS and LDAPS/STARTTLS (LDAP_ALLOW_INSECURE=false by default in production). No MD4, MD5, single DES, RC4, or Dual_EC_DRBG appears in application code. SECURITY.md and README explicitly document avoiding weak algorithms.

Key URLs: https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#cryptography-practices https://github.com/imRezaAlie/openits/blob/main/config/app.php https://github.com/imRezaAlie/openits#security

OpenITS avoids cryptographic algorithms and modes with known serious weaknesses in its default security mechanisms. Password hashing uses bcrypt (not SHA-1). Application encryption uses AES-256-CBC via Laravel (not SSH CBC). API tokens use Laravel Sanctum (SHA-256 class hashing). The project does not implement SSH or use MD5, SHA-1, DES, or RC4 for security-sensitive operations. SECURITY.md documents avoidance of weak algorithms.

Key URLs: https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#cryptography-practices https://github.com/imRezaAlie/openits/blob/main/config/app.php https://github.com/imRezaAlie/openits#security

OpenITS does not implement its own key-agreement protocols. Session and transport security rely on TLS, which supports perfect forward secrecy when deployed with modern cipher suites (e.g. ECDHE). Production hardening documentation requires HTTPS, LDAPS, or STARTTLS.

Key URLs: https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#security-hardening-recommendations https://github.com/imRezaAlie/openits#security

Local user passwords are stored as bcrypt iterated hashes with per-user salts via Laravel's Hash facade (Hash::make() / bcrypt()). Default cost is 12 rounds (BCRYPT_ROUNDS=12 in .env.example). LDAP and Google users do not have their external passwords stored locally.

Key URLs: https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#cryptography-practices https://github.com/imRezaAlie/openits/blob/main/.env.example https://github.com/imRezaAlie/openits/blob/main/app/Http/Controllers/Auth/RegisterController.php

Cryptographic keys and tokens are generated with cryptographically secure sources. Laravel's Str::random() (used for C4 share tokens and placeholder passwords) and php artisan key:generate (APP_KEY) use PHP's random_bytes() CSPRNG. Sanctum API tokens and session IDs are generated by Laravel's secure mechanisms. Math.random() appears only in third-party UI libraries for non-security IDs (diagram elements), not for cryptographic keys or nonces.

Key URLs: https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#cryptography-practices https://github.com/imRezaAlie/openits/blob/main/app/Http/Controllers/C4Controller.php https://github.com/imRezaAlie/openits/blob/main/app/Services/LdapAuthService.php

Distribution channels use HTTPS exclusively. [osps_br_03_02]

OpenITS does not distribute cryptographic hashes (e.g. sha1sum) over HTTP for users to verify downloads. The software is obtained via HTTPS Git clone and HTTPS GitHub releases. Composer dependencies are also fetched over HTTPS. No unsigned hash files are published for download verification.

Key URLs: https://github.com/imRezaAlie/openits#obtaining-openits https://github.com/imRezaAlie/openits/releases

There are no published security advisories or publicly known CVEs (CVSS ≥ 4.0) for OpenITS that have remained unpatched for more than 60 days. The GitHub Security Advisories page shows no published advisories for this repository.

Key URLs: https://github.com/imRezaAlie/openits/security/advisories https://github.com/imRezaAlie/openits/releases

No critical vulnerabilities have been publicly reported for OpenITS to date. SECURITY.md defines a rapid response process for future reports: initial acknowledgment within 48 hours and prioritized handling of critical severity issues.

Key URLs: https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#response-timeline https://github.com/imRezaAlie/openits/blob/main/SECURITY.md#reporting-a-vulnerability https://github.com/imRezaAlie/openits/security/advisories

The repository does not contain valid production credentials or private keys. .env is gitignored; .env.example uses empty placeholders only. The seeded demo account (admin@openits.local / password) is documented sample credentials for local development only, not intended to protect public production access. README instructs changing this password immediately in production.

Key URLs: https://github.com/imRezaAlie/openits/blob/main/.gitignore https://github.com/imRezaAlie/openits/blob/main/.env.example https://github.com/imRezaAlie/openits#default-admin-account

The project uses Laravel Pint for code style (composer lint) but does not apply a dedicated static analysis tool (e.g., PHPStan/Larastan/Psalm) before major releases. Pint alone does not satisfy this criterion.
Key URLs:
https://github.com/imRezaAlie/openits/blob/main/composer.json
https://github.com/imRezaAlie/openits/releases/tag/v1.1.0

No static analysis tool with vulnerability-detection rules is configured. Adding Larastan/PHPStan with security-focused rules (e.g., phpstan/phpstan-strict-rules or a security plugin) would satisfy this criterion.
Key URLs:
https://github.com/imRezaAlie/openits/blob/main/composer.json
https://github.com/imRezaAlie/openits/blob/main/pint.json

Static code analysis is not yet configured for this project, so there are no static-analysis findings to remediate. This criterion applies once a tool such as Larastan/PHPStan is adopted.

Key URL:
https://github.com/imRezaAlie/openits/blob/main/composer.json

The project is a Laravel (PHP) web application with JavaScript frontend assets. No C/C++ or other memory-unsafe language code is produced by the project.

Key URL:
https://github.com/imRezaAlie/openits/blob/main/composer.json

PHPUnit dynamic testing uses assertions in the dedicated test configuration. Production deployment documentation requires APP_DEBUG=false.

Key URLs:
https://github.com/imRezaAlie/openits/blob/main/phpunit.xml
https://github.com/imRezaAlie/openits#build--test
https://github.com/imRezaAlie/openits#security

No dynamic code analysis vulnerability findings exist. PHPUnit functional tests are used, but no DAST/fuzzing tool has reported exploitable vulnerabilities.

Key URLs:
https://github.com/imRezaAlie/openits/tree/main/tests
https://github.com/imRezaAlie/openits/blob/main/phpunit.xml