SecObserve

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

All development happen in feature branches on the GitHub repository.

Repository on GitHub, which uses git. git is distributed.

Every release has a unique version number

There is a tag on the main branch for every release.

Release notes are published on GitHub, listing the new features, fixes, chores and dependency updates plus potential breaking changes. See https://github.com/MaibornWolff/SecObserve/releases.

There has been no publicly known vulnerabilities so far.

Bugs can be reported via GitHub issues on https://github.com/MaibornWolff/SecObserve/issues.

Issues are tracked on GitHub on https://github.com/MaibornWolff/SecObserve/issues.

No bug reports have been filed so far, but every bug report will be triaged and answered as soon as possible.

All enhancement requests have been answered by the development team, giving a response how the development team will procede.

All closed issues are stored on GitHub, see https://github.com/MaibornWolff/SecObserve/issues?q=is%3Aissue+is%3Aclosed

There is a published security policy at https://github.com/MaibornWolff/SecObserve/security/policy.

GitHub security advisories are used to privately report vulnerabilities, the link is published in the security policy, see https://github.com/MaibornWolff/SecObserve/security/policy.

There have been no vulnerability reports in the last 6 months.

Dockerfiles are used to build the Python/Django backend and the TypeScript/React frontend into Docker images

The frontend uses vite to compile the TypeScript sources and dependencies. The Python backend doesn't need to be built.

Vite is open source (https://github.com/vitejs/vite)

There are unittests for the Python backend, using the unittest packages of Python and Django. There is a set of high-level test cases for the frontend, using Playwright.

For both backend and frontend testsuites there is a Docker Compose file, that can be used to run the testsuites and document all needed parameters.

The unittests for the backend cover currently 83% of the code.

Development happens with feature branches with automated tests running for every push.

The contributing guidelines (https://github.com/MaibornWolff/SecObserve/blob/dev/CONTRIBUTING.md) state: "All new features and bug fixes in the backend shall be accompanied by unit tests." This will be checked before accepting pull requests.

The unittest coverage for the backend is currently at 83% and shall stay this high. You will find changes and additional unittests in merely all pull requests.

The contributing guidelines (https://github.com/MaibornWolff/SecObserve/blob/dev/CONTRIBUTING.md) state: "All new features and bug fixes in the backend shall be accompanied by unit tests."

The majority of function definitions in the backend Python code have type hints. The tool "mypy" checks the type hints and "pylint" is used for linting. The frontend is written in TypeScript to enforce strong typing and "eslint" is used for linting. Linting is enforced for both backend and frontend in GitHub actions running on every commit.

No warnings or errors are allowed to be reported before merging a pull request to dev or main.

No warnings or errors are allowed to be reported before merging a pull request to dev or main.

The founder and maintainer of SecObserve has more than 30 years experience in commercial software development and more the 5 years working in security related positions.

The founder and maintainer of SecObserve has more than 30 years experience in commercial software development and more the 5 years working in security related positions. SecObserve is exactly about finding and mitigating security vulnerabilities.

Cryptography is used to store passwords/API tokens and to encrypt some other sensitive attributes in the database. Passwords and API tokens are stored using Argon2Id, other encrypted fields use the Python cryptography.fernet package.

see above

see above

Fernet uses 128-bit AES in CBC mode for encryption and HMAC with SHA-256 for integrity.

No broken cryptographic algorithm is uses, see above.

128-bit AES in CBC mode for encryption and HMAC with SHA-256 for integrity is not considered as weak.

Password for users and API tokens are stored using Argon2id with per-user-salts.

No cryptographic key or nonces are generated by the application

Delivery happens either via cloning the source code from GitHub or pulling the docker images from Docker Hub. Both methods enforde https or ssh.

Hashes for the docker images are retrieved from Docker Hub via https.

There have been no publicly known vulnerabilities for SecObserve so far. Vulnerabilities of dependencies are monitored and triaged regularly. The project has a release cycle of at least once per month, including vulnerability fixes.

see above

The vulnerability checks (https://github.com/MaibornWolff/SecObserve/blob/dev/.github/workflows/check_vulnerabilities.yml) include checks for secrets in the repository. If secrets would be found, they would be changed and removed from the repository.

Backend (Python): CodeQL, Bandit, Semgrep, PyLint, MyPy Frontend (TypeScript): CodeQL, Eslint(-security), Semgrep Docker: Checkov, KICS Secrets: Gitleaks

CodeQL, Bandit, Semgrep, Eslint(-security), Gitleaks, Checkov and KICS are focussed on security vulnerabilities

All findings are imported in a SecObserve instance, triaged there and then fixed in the source code, if the assessment has confirmed they are a vulnerability.

All vulnerability checks run with every commit.

Several dynamic checks are run when a new development is deployed in MaibornWolff's environment: - ZAP baseline checks for both backend and frontend - ZAP API scan for the backend - ZAP full scan for the frontend (without authentication)

Python and TypeScript are considered as memory-safe

As with the SAST, the ZAP findings are imported in a SecObserve instance, triaged there and fixed as soon as possible if confirmed as a vulnerability.