vinyldns

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

All PRs are reviewed before being merged.

At Comcast, we release interim versions regularly (at least weekly) to ensure that a version is stable prior to public release of the version

Repository on GitHub, which uses git. git is distributed.

We currently have one release, but it is unique and uses SEMVER - https://github.com/vinyldns/vinyldns/releases

Github Releases - https://github.com/vinyldns/vinyldns/releases

Example Release Notes - https://github.com/vinyldns/vinyldns/releases/tag/v0.8.0

We have not had a release with publicly known vulnerabilities

https://github.com/vinyldns/vinyldns/blob/master/CONTRIBUTING.md#submitting-an-issue

Uses Github Issues - https://github.com/vinyldns/vinyldns/issues

https://github.com/vinyldns/vinyldns/issues - 27 of 34 closed in the last 12 months

https://github.com/vinyldns/vinyldns/issues - 27 of 34 closed in the last 12 months

Github Issues - https://github.com/vinyldns/vinyldns/issues - 27 of 34 closed in the last 12 months

Provide a mail for security vulnerabilities - https://github.com/vinyldns/vinyldns#contact

Uses a private mailing address - https://github.com/vinyldns/vinyldns#contact

No vulnerabilities have been reported

Non-trivial build file in repository: https://github.com/vinyldns/vinyldns/blob/master/build.sbt.

Non-trivial build file in repository: https://github.com/vinyldns/vinyldns/blob/master/build.sbt.

SBT is used for building, available under APL 2.0 - https://github.com/sbt/sbt

Functional test suite uses pytest (https://github.com/pytest-dev/pytest) - Func Test Suite - https://github.com/vinyldns/vinyldns/tree/master/modules/api/functional_test

Also, unit tests use scala check

Invocable using sbt - https://github.com/vinyldns/vinyldns/blob/master/DEVELOPER_GUIDE.md#testing

Code coverage currently at 96% - https://codecov.io/gh/vinyldns/vinyldns

Use Travis for continuous integration - https://travis-ci.org/vinyldns/vinyldns

https://github.com/vinyldns/vinyldns/blob/master/CONTRIBUTING.md#testing

Code cov is reported on every PR to ensure that code coverage has not dropped

https://github.com/vinyldns/vinyldns/blob/master/CONTRIBUTING.md#testing

Several compiler flags are enabled on the project - https://github.com/vinyldns/vinyldns/blob/master/project/CompilerOptions.scala

Compiler flags are set to "fatal", meaning the build will fail if they are violated

Most major compiler flags are on - https://github.com/vinyldns/vinyldns/blob/master/project/CompilerOptions.scala

The development team works closely with Comcast security to review the application.

We regularly work on application requiring CSRF, CORS remediation. Follow security best practices such as using TLS, disabling weak ciphers, not using TLS 1.0, and enforcing secure headers in our installations.

Symmetric cryptography is pluggable, allowing users to implement their own. Our default cryptography uses 256-bit AES with CBC/PKCS5Padding

Our default cryptography leverages Java standard crypto

Java standard crypto is FLOSS

We use AES 256-bit

We do not rely on any broken cryptographic algorithms in the product

We do not store user passwords

Any keys we generate for the application use org.apache.commons.lang3.RandomStringUtils

Application uses HTTPS and AWS SIG4 to sign all requests, preventing MITM attacks

We do not use the application over http

There are no vulnerabilities yet found

There are no vulnerabilities yet found

The only credentials available are for testing

Unknown of FLOSS for Scala

We use commercial software for static analysis internally at Comcast that are run daily

No security vulnerabilities have been detected since open sourcing from our internal security scans

We run static analysis daily, but internally as our software is paid (not FLOSS)

No source code security vulnerabilities have been found via dynamic code analysis