presidio

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The project is hosted on GH and features not only main branch: https://github.com/microsoft/presidio/branches. The development team is using an an internal Azure based dev environment.

Repository on GitHub, which uses git. git is distributed.

The project releases https://github.com/microsoft/presidio/releases use the SemVer format for versioning every release using VERSION file https://github.com/microsoft/presidio/blob/main/VERSION

The project uses unique git tags for each release: https://github.com/microsoft/presidio/releases/tag/2.2.28

Non-trivial release notes file in repository: https://github.com/microsoft/presidio/blob/main/CHANGELOG.md.

there have been no publicly known vulnerabilities

The project uses GitHub issues as the main issue tracker: https://github.com/microsoft/presidio/issues

The project uses GitHub issues as the main issue tracker: https://github.com/microsoft/presidio/issues

The project has 31 open/closed issues that are tagged as "bug" https://github.com/microsoft/presidio/issues?q=is%3Aissue+label%3Abug+ by the maintainers

The project closed issues https://github.com/microsoft/presidio/issues?q=is%3Aissue+is%3Aclosed has 30 closed issues with "bug" label.

The project uses GitHub issues as the main issue tracker: https://github.com/microsoft/presidio/issues

Vulnerability reporting is published on the project's FAQ: https://microsoft.github.io/presidio/faq/#contributing

The project Security guide includes guide on how to privately submit vulnerabilities: https://github.com/microsoft/presidio/blob/main/SECURITY.md#reporting-security-issues

vulnerabilities submission is provided by Microsoft Security Response Center

The project uses pipenv, standard python build and test and docker for building and testing the software (https://microsoft.github.io/presidio/development/). continuous integration automates the build process using Azure DevOps (https://microsoft.github.io/presidio/build_release/).

The project uses pipenv, standard python build and test and docker for building and testing the software (https://microsoft.github.io/presidio/development/).

The project uses pipenv, standard python build and test and docker for building and testing the software (https://microsoft.github.io/presidio/development/).

The project unit and integration tests are executed using pytest https://microsoft.github.io/presidio/development/#testing and the process is explained in the Contributing guidelines: https://github.com/microsoft/presidio/blob/main/CONTRIBUTING.md#how-can-i-contribute

The project unit and integration tests are executed using pytest https://microsoft.github.io/presidio/development/#testing

Coverage is not implemented in CI or PR validation, but running coverage manually shows that MOST code is covered.

continuous integration automates the build process using Azure DevOps (https://microsoft.github.io/presidio/build_release/)

As part of the PR template, new functionality is required to add tests: https://github.com/microsoft/presidio/blob/main/.github/PULL_REQUEST_TEMPLATE.md

All recent code-changing PRs include adding tests to the automated testing suite: https://github.com/microsoft/presidio/pull/849 https://github.com/microsoft/presidio/pull/858 https://github.com/microsoft/presidio/pull/841

As part of the PR template, new functionality is required to add tests: https://github.com/microsoft/presidio/blob/main/.github/PULL_REQUEST_TEMPLATE.md

The project uses flake8 and black to lint the code for code quality errors.

The project uses flake8 and black to lint the code for code quality errors. The linter is setup to be strict and not allow new warnings to be committed.

from https://github.com/microsoft/presidio/graphs/contributors: https://github.com/balteravishay is a security champ for Microsoft CSE and graduate of ossf developing secure software course. https://github.com/eladiw is a security champ for Microsoft CSE

from https://github.com/microsoft/presidio/graphs/contributors: https://github.com/balteravishay is a security champ for Microsoft CSE and graduate of ossf developing secure software course. https://github.com/eladiw is a security champ for Microsoft CSE

For anonymization of data, the project uses AES algorithm

For anonymization of data, the project uses standard python AES lib (pycryptodome)

For anonymization of data, the project uses standard python AES lib (pycryptodome)

the project uses built in functionality from the standard python AES library (pycryptodome) to determine that the key length is legitimate (at least 128 bit long)

For anonymization of data, the project uses standard python AES lib (pycryptodome)

For anonymization of data, the project uses standard python AES lib (pycryptodome)

The software does not hold keys

The software does not hold keys or passwords

The software does not generate keys

the project uses only certified tools to deliver artifacts such as twine and docker

cryptographic hash are not used in the releaser

There have been no vulnerabilities of medium or higher severity so far in the repository

There have been no vulnerabilities of medium or higher severity so far in the repository.

The project PR validation process and the CI include security scanning tools that check the code for passwords and keys: https://github.com/microsoft/presidio/blob/main/.pipelines/templates/security-analysis.yml

The project uses CodeQL queries provided by GH to scan for known CVEs: https://github.com/microsoft/presidio/security/code-scanning

The project uses CodeQL queries provided by GH to scan for known CVEs: https://github.com/microsoft/presidio/security/code-scanning

None found

the codeQL action is executed for every pull request: https://github.com/microsoft/presidio/blob/bcd32322034fb773579cb12758b6c7161bc479f0/.github/workflows/codeql-analysis.yml#L17

the project has an open issue to use a dynamic analysis tool: https://github.com/microsoft/presidio/issues/873 additionally the project had started a proposal process for the oss-fuzz project here: https://github.com/google/oss-fuzz/pull/7783