DockSec

DockSec is an official OWASP project hosted under the OWASP GitHub organization. OWASP organization policies strictly enforce multi-factor authentication (MFA) for all members and collaborators with write access to the repository. GitHub requires 2FA as of March 2023.

We follow the principle of least privilege. New collaborators are added via the OWASP organization's standard onboarding process, which defaults to the lowest necessary permissions. Manual assignment by project leads is required for elevated access.

Direct commits to the main branch are prevented through GitHub branch protection rules. All changes must be submitted via pull requests and require passing status checks (CI/CD) and approval from at least one maintainer.

The main branch is designated as a protected branch in GitHub settings, which prevents accidental or intentional deletion of the primary codebase history.

Our GitHub Actions workflows (python-app.yml) use standard, trusted actions (e.g., actions/checkout, actions/setup-python). The DockSec CLI itself implements strict input validation for Dockerfile paths and image names to prevent injection attacks during pipeline execution.

Sensitive credentials, such as the PYPI_API_TOKEN, are stored exclusively in GitHub Actions Secrets. Workflows are configured to prevent these secrets from being exposed in logs, and they are only accessible to authorized release jobs.

All official project channels, including the OWASP project page, GitHub repository, and OWASP Slack links, are exclusively delivered via HTTPS.

DockSec is distributed via PyPI and GitHub Releases. Both platforms use cryptographically authenticated HTTPS channels to protect against adversary-in-the-middle attacks during package download and installation.

We maintain a robust .gitignore file that prevents the accidental commit of .env files, credentials, or local configuration. Our SECURITY.md provides clear guidance to users and contributors on never committing API keys to version control.

Comprehensive user documentation is provided in the README.md (Quick Start, CLI Usage) and a dedicated tab_gettingstarted.md file, covering installation, configuration, and basic to advanced usage.

The CONTRIBUTING.md file contains a dedicated "Reporting Bugs" section with clear instructions and links to our GitHub Issue templates for standardized reporting.

We use multiple public mechanisms for discussion, including the #project-docksec channel on OWASP Slack, GitHub Issues for bug tracking, and GitHub Discussions for general queries and proposals.

A detailed contribution workflow is documented in CONTRIBUTING.md, including development setup, code style guidelines, and the pull request process.

The source code is licensed under the MIT License, which is OSI-compliant. The full license text is maintained in the LICENSE file in the repository root.

All released software assets (e.g., PyPI packages) are distributed under the same MIT License, as specified in setup.py and pyproject.toml.

The LICENSE file is present in the root of the authoritative repository.

The MANIFEST.in file ensures that the LICENSE file is included in all source distributions and release assets.

The project's source code is publicly readable at the static URL: https://github.com/OWASP/DockSec

The full history of changes, including authorship and timestamps, is publicly available through the GitHub commit history.

We maintain explicit dependency lists in requirements.txt, setup.py, and pyproject.toml, accounting for all direct language dependencies.

DockSec is a single-repository project. The project structure and the role of each directory are clearly documented in the "Project Structure" section of CONTRIBUTING.md.

The version control system does not contain generated executable artifacts. Our .gitignore prevents the inclusion of build artifacts like dist/, build/, and pycache.

The repository contains only reviewable source code, configuration files, and documentation. Images in the images/ directory are standard PNG files used for documentation purposes.

Our docs/SECURITY.md file explicitly lists security contacts and provides a clear process for reporting vulnerabilities privately via email or GitHub Security Advisories.