qisutu

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The public main branch contains ongoing development commits and reviewable intermediate versions between stable releases. Qisutu 1.0.3 is currently developed publicly through individual commits and contributions rather than being uploaded only as a final release: https://github.com/qisutu/qisutu/commits/main/.

Repository on GitHub, which uses git. git is distributed.

Every Qisutu release has a unique version number. The version is stored in release.conf and the Qisutu configuration, displayed by the application, used in release archive names, and verified by the automated release-package-integrity test: https://github.com/qisutu/qisutu/blob/main/release.conf.

Qisutu 1.0.2 is identified by the Git tag v1.0.2: https://github.com/qisutu/qisutu/tree/v1.0.2

Human-readable release notes for Qisutu 1.0.2, including major changes and upgrade impact, are published in CHANGELOG.md: https://github.com/qisutu/qisutu/blob/main/CHANGELOG.md

No publicly known Qisutu runtime vulnerability with a CVE or comparable public identifier was fixed in release 1.0.2. This is stated in CHANGELOG.md: https://github.com/qisutu/qisutu/blob/main/CHANGELOG.md

GitHub provides defect reporting mechanisms by default (via issuThe bug-reporting process is documented in CONTRIBUTING.md: https://github.com/qisutu/qisutu/blob/main/CONTRIBUTING.md. Bug reports are submitted through GitHub Issues: https://github.com/qisutu/qisutu/issues.es). [osps_do_02_01]

Qisutu uses GitHub Issues to track individual bugs and enhancement requests: https://github.com/qisutu/qisutu/issues.

Qisutu has no bug reports in the applicable 2–12 month period because the public project is newer than two months. There is therefore no unacknowledged majority from that period. Current reports and contributions are reviewed through GitHub: https://github.com/qisutu/qisutu/issues.

Qisutu has no enhancement requests in the applicable 2–12 month period because the public project is newer than two months. Current enhancement requests and pull requests are reviewed through GitHub: https://github.com/qisutu/qisutu/issues.

GitHub Issues provides a public, searchable archive of Qisutu reports and responses, with a permanent URL for each report: https://github.com/qisutu/qisutu/issues.

The vulnerability-reporting process, required report information, response procedure, disclosure rules, and scope are published in SECURITY.md: https://github.com/qisutu/qisutu/blob/main/SECURITY.md

SECURITY.md instructs reporters not to use public GitHub issues and to send vulnerability reports privately by email to support@qisutu.de: https://github.com/qisutu/qisutu/blob/main/SECURITY.md

Qisutu has not received any vulnerability report during the last six months. SECURITY.md nevertheless commits the project to acknowledging future vulnerability reports within 14 calendar days: https://github.com/qisutu/qisutu/blob/main/SECURITY.md

Qisutu is distributed as complete Perl source code, SQL, templates, JavaScript, and CSS. It is interpreted and installed directly from the source package, so no compilation or separate build step is required. Installation is documented in INSTALL.md: https://github.com/qisutu/qisutu/blob/main/INSTALL.md

Not applicable because Qisutu is interpreted and distributed as complete source code. There is no compilation or separate build process.

Not applicable because Qisutu requires no build process. The distributed source is installed and executed directly.

Qisutu includes a public automated Perl TAP test suite in the t/ directory. The complete test command is documented in DEVELOPMENT.md. The current suite contains 51 test files and 1,866 successful tests: https://github.com/qisutu/qisutu/blob/main/DEVELOPMENT.md and https://github.com/qisutu/qisutu/tree/main/t.

The test suite uses Perl's standard TAP format and is invoked with the standard prove test runner. The complete command is documented in DEVELOPMENT.md: https://github.com/qisutu/qisutu/blob/main/DEVELOPMENT.md.

Qisutu requires automated tests for major new functionality and reproducible defect corrections. The policy, including successful, validation, permission, and error paths, is documented in DEVELOPMENT.md: https://github.com/qisutu/qisutu/blob/main/DEVELOPMENT.md.

Recent major Qisutu functionality has corresponding automated tests, including the REST API, add-on framework, customer automatic responses, LDAP authentication, and release-package integrity. Examples are t/rest-api.t, t/addon-framework.t, t/customer-auto-responses.t, t/ldap-authentication.t, and t/release-package-integrity.t: https://github.com/qisutu/qisutu/tree/main/t.

CONTRIBUTING.md requires contributors to add or update tests when behavior changes and links to the detailed test policy in DEVELOPMENT.md: https://github.com/qisutu/qisutu/blob/main/CONTRIBUTING.md and https://github.com/qisutu/qisutu/blob/main/DEVELOPMENT.md.

Qisutu production Perl files enable the strict and warnings language modes. This requirement and the syntax-check command are documented in DEVELOPMENT.md: https://github.com/qisutu/qisutu/blob/main/DEVELOPMENT.md.

Warnings from syntax checks and the automated test suite must be investigated and corrected under the policy in DEVELOPMENT.md. The current complete test run finished successfully with all 51 test files and 1,866 tests passing: https://github.com/qisutu/qisutu/blob/main/DEVELOPMENT.md.

Qisutu production Perl code uses both strict and warnings, which are the standard strict language and warning modes for Perl. Changed Perl files are required to retain both modes under DEVELOPMENT.md: https://github.com/qisutu/qisutu/blob/main/DEVELOPMENT.md.

Qisutu has a primary developer with practical secure-software design knowledge. The implemented controls include CSRF protection, scoped REST tokens, permission checks, secure session cookies, secret encryption, secure random generation, TOTP, input validation, attachment controls, and automated security tests in t/security.t and t/attachment-security.t: https://github.com/qisutu/qisutu/tree/main/t.

The primary development work demonstrates knowledge of common web-application vulnerabilities and mitigations, including SQL injection through parameterized queries, XSS through output handling, CSRF tokens, authorization and queue-permission checks, session protection, upload validation, rate limiting, secure secret storage, and prevention of credential leakage. Security-related behavior is covered by public automated tests: https://github.com/qisutu/qisutu/tree/main/t.

Qisutu uses publicly specified and widely reviewed cryptographic primitives through standard system and Perl cryptographic implementations, including SHA-256, HMAC, AES-256, SHA-512 crypt password hashes, and standards-based TOTP. It does not use proprietary cryptographic algorithms. Relevant implementation and tests are public in core/system/QisutuSecurity.pm and t/security.t: https://github.com/qisutu/qisutu/blob/main/core/system/QisutuSecurity.pm and https://github.com/qisutu/qisutu/blob/main/t/security.t.

Qisutu does not implement its own cryptographic primitives. It uses established FLOSS implementations provided by OpenSSL, Perl Digest::SHA, and the operating system crypt function. Qisutu only applies these implementations to its application-level encryption, hashing, token, and TOTP workflows: https://github.com/qisutu/qisutu/blob/main/core/system/QisutuSecurity.pm.

All Qisutu cryptographic functionality is implemented with FLOSS components available on the supported Linux platform, including OpenSSL, Perl Digest::SHA, and the operating system crypt implementation. No proprietary cryptographic component or service is required.

Qisutu uses fixed secure-strength mechanisms, including AES-256 for stored secrets, SHA-256/HMAC-SHA-256 where applicable, securely generated long API tokens, and SHA-512 crypt password hashes. Qisutu does not offer a configuration option that downgrades stored-secret encryption to a smaller AES key size: https://github.com/qisutu/qisutu/blob/main/core/system/QisutuSecurity.pm and https://github.com/qisutu/qisutu/blob/main/core/system/QisutuAPIAuth.pm.

Qisutu does not depend on broken cryptographic algorithms such as MD4, MD5, DES, or RC4. Stored secrets use AES-256-CBC with independent encryption and authentication keys and an encrypt-then-MAC construction using HMAC-SHA-256; the MAC is verified before decryption. HMAC-SHA-1 is used only for standards-compatible TOTP and not as a collision-resistant hash: https://github.com/qisutu/qisutu/blob/main/core/system/QisutuSecurity.pm.

Qisutu does not depend on cryptographic mechanisms with known serious weaknesses. AES-256-CBC is protected with encrypt-then-MAC using HMAC-SHA-256 and independent keys. SHA-1 is used only as HMAC-SHA-1 for interoperable standards-based TOTP, where collision attacks against plain SHA-1 do not apply: https://github.com/qisutu/qisutu/blob/main/core/system/QisutuSecurity.pm.

Not applicable. Qisutu does not implement its own network key-agreement protocol. HTTPS/TLS and forward secrecy are provided by the administrator's web-server and OpenSSL configuration. Qisutu's internal cryptography protects stored secrets at rest and is not a key-agreement protocol.

Qisutu stores local passwords as per-password salted, iterated SHA-512 crypt hashes. Plaintext passwords are not stored. Password verification uses the parameters contained in the stored hash, and password creation and reset use securely generated salts.

Qisutu generates cryptographic keys, salts, initialization vectors, nonces, CSRF tokens, and API tokens using cryptographically secure random data from /dev/urandom. The operation fails if secure random data cannot be obtained: https://github.com/qisutu/qisutu/blob/main/core/system/QisutuSecurity.pm

Qisutu release archives and their SHA-256 checksum files are distributed through HTTPS from the official Qisutu and GitHub servers. Qisutu does not retrieve a cryptographic hash over unauthenticated HTTP and then use it without authenticated transport.

Qisutu release archives and their SHA-256 checksum files are distributed through HTTPS from the official Qisutu and GitHub servers. Qisutu does not retrieve a cryptographic hash over unauthenticated HTTP and then use it without authenticated transport.

Qisutu has no publicly known unpatched vulnerabilities of medium or higher severity that have remained unresolved for more than 60 days. Vulnerability reports are handled according to the published security process: https://github.com/qisutu/qisutu/blob/main/SECURITY.md

Qisutu fixes critical vulnerabilities as rapidly as possible after they are reported. The responsible disclosure and vulnerability-handling process is documented in SECURITY.md: https://github.com/qisutu/qisutu/blob/main/SECURITY.md

The Qisutu public repository does not contain valid private credentials. Configuration files use placeholders, while passwords, API tokens, encryption keys, and other instance-specific secrets are generated or configured locally during installation and are not committed to the public repository.

Qisutu uses the FLOSS static-analysis tool Perl::Critic with the project profile in .perlcriticrc. The analysis command tools/qisutu-static-analysis examined 268 first-party Perl files successfully with no violations before release. The required release gate is documented in DEVELOPMENT.md.

Qisutu uses Perl::Critic rules that check for common Perl security and correctness risks, including unsafe file-opening forms, bareword file handles, unchecked system and exec calls, and prohibited modules. These checks are applied to the first-party Perl source code before release.

Qisutu requires confirmed medium and higher severity exploitable vulnerabilities discovered by static analysis to be fixed before release. The current Perl::Critic analysis examined 268 first-party Perl files and reported no violations requiring correction.

Qisutu applies its automated Perl test suite as dynamic analysis before a proposed major production release. The test suite executes project code and currently contains 52 test files with 1,875 successfully completed tests. The required command and release procedure are documented in DEVELOPMENT.md.

Qisutu is implemented in memory-safe languages, primarily Perl and JavaScript, and does not contain project-produced software written in a memory-unsafe language such as C or C++. Therefore, this criterion is not applicable.

Qisutu’s dynamic test configuration uses Perl Test::More assertions throughout the automated test suite. These test assertions are enabled during testing and are not part of the production runtime configuration.

Qisutu requires confirmed medium and higher severity exploitable vulnerabilities discovered through dynamic analysis and automated testing to be fixed before release. The current automated test run completed 1,875 tests successfully and reported no confirmed vulnerabilities requiring correction.