JHipster

https://github.com/jhipster/generator-jhipster.git

https://github.com/jhipster/generator-jhipster.git

We always use Pull Requests on GitHub, see https://github.com/jhipster/generator-jhipster/pulls?q=is%3Apr+is%3Aclosed

Yes we use Git

https://www.jhipster.tech/releases/

Each release on https://www.jhipster.tech/releases/ is linked to a Git tag, with the same version, that's part of the release process

Here are all our release notes: https://www.jhipster.tech/releases/

We always tell those in our release notes at https://www.jhipster.tech/releases/ For example see https://www.jhipster.tech/2018/05/11/jhipster-release-4.14.4.html

https://github.com/jhipster/generator-jhipster/issues/new/choose

https://github.com/jhipster/generator-jhipster/issues

See https://github.com/jhipster/generator-jhipster/issues - at the moment of this writing we have 36 open bugs out of 4,331 closed bugs. As you can see, we usually fix bugs in a matter of hours/days. If it's a major issue, we usually have a release in the following day.

Same thing as above, see https://github.com/jhipster/generator-jhipster/labels/enhancement -> we have 5 enhancements requests open and 443 closed. They are usually done within a week.

We use the issue tracker for that https://github.com/jhipster/generator-jhipster/issues - everything is available and searchable there

See https://www.jhipster.tech/help/ -> usually people just submit a bug report, but sometimes if that's really urgent they contact us on Twitter

We don't have private vulnerability reports, everything is public on the project.

Usually we do this in the next day, never more than 3 days for sure.

It's built with NPM/Yarn, and what we generate is built with Maven/Gradle (for the Java part) and NPM/Yarn (for the front-end part)

NPM/Yarn/Maven/Gradle are all very common tools

NPM/Yarn/Maven/Gradle are all FLOSS

The full test suite is at https://github.com/jhipster/generator-jhipster/tree/master/test But we do far better, with complete integration testing on Travis, and the code is at https://github.com/jhipster/generator-jhipster/tree/master/travis - the script at https://github.com/jhipster/generator-jhipster/blob/master/travis/build-samples.sh allow people to test the Travis build locally

Just run "yarn test" or "npm test"

For the final tests (this includes the integration tests), Sonar says we have 84,5% of coverage at the date of this writing. The live report is at https://sonarcloud.io/dashboard?id=io.github.jhipster.sample%3Ajhipster-sample-application (it's re-generated with each commit)

We use Travis at https://travis-ci.org/jhipster/generator-jhipster

It's requirement in https://github.com/jhipster/generator-jhipster/blob/master/CONTRIBUTING.md#submit and also the code must pass the Sonar quality gate at https://sonarcloud.io/dashboard?id=io.github.jhipster.sample%3Ajhipster-sample-application

We don't allow major features without tests. Anyway it wouldn't pass the Sonar quality gate at https://sonarcloud.io/dashboard?id=io.github.jhipster.sample%3Ajhipster-sample-application

The rule is at https://github.com/jhipster/generator-jhipster/blob/master/CONTRIBUTING.md#submit

We have a lint in our test suite at https://github.com/jhipster/generator-jhipster/tree/master/test - it's just not possible to pass the tests (that's the first test in our Travis test) if there is a lint error

We don't allow warnings, see the above section about the "lint", it can't go pass the tests, so the PR will not be processed

We are very strict and don't allow them at all

I'm the lead developer so I'm the primary developer. I've got 20 years of experience, worked for several very high security systems (including several software for the French central bank), and I am a Java Champion (see https://community.oracle.com/community/technology_network_community/java/java-champions ). In the core team we also have Matt Raible, who is also a Java Champion, and who works for https://www.okta.com/

As written above, me & Matt Raible are worldwide recognized experts in that field.

As you can see in https://github.com/jhipster/generator-jhipster/blob/master/generators/server/templates/src/main/java/package/security/jwt/TokenProvider.java.ejs we use java.security.Key as well as strong encryption provided by https://github.com/jwtk/jjwt for securing our tokens. FYI the algorithm is HMAC-SHA-512. This is done with the help of Okta, where Matt Raible and the lead JJWT developer both work.

See above, that's the case in https://github.com/jhipster/generator-jhipster/blob/master/generators/server/templates/src/main/java/package/security/jwt/TokenProvider.java.ejs

Yes https://github.com/jwtk/jjwt is FLOSS

That's provided by https://github.com/jwtk/jjwt - the library will fail if you provide a key which is too short. So for HMAC-SHA-512 (our algorithm) this is 512 bytes. And if the library fails our software does not start, of course.

This is HMAC-SHA-512 and that's not broken yet

This is HMAC-SHA-512 and it's good as of now

This doesn't make sense for us, this is for securing a webapp and the default validity for a key is 30 minutes...

Yes, when a password is stored, it is hashed with Bcrypt, see https://github.com/jhipster/generator-jhipster/blob/4623dea96ad39d561732d422351674b11b415e4c/generators/server/templates/src/main/java/package/config/SecurityConfiguration.java.ejs#L193

We use the crypto function from NodeJS to generate the key, see https://github.com/jhipster/generator-jhipster/blob/4a3184ae352cec0a26f696d75a4c34992552a654/generators/server/prompts.js#L288 But we recommend our users to generate their own key and not use this one, which is just there for development purpose

We provide full documentation and support for TLS, see https://github.com/jhipster/generator-jhipster/blob/v5.2.1/generators/server/templates/src/main/resources/config/application-prod.yml.ejs#L206

If you follow our documentation above, this is not possible as you use TLS

You can check at https://github.com/jhipster/generator-jhipster/issues there's nothing at the moment

Usually we do this 1 to 3 days after a vulnerability

There's no such thing in our GitHub repo. Yes there are sample credentials, but they are only there to show how things work, and they are documented as such.

After each commit we have a Sonar analysis on https://sonarcloud.io/dashboard?id=io.github.jhipster.sample%3Ajhipster-sample-application

That's what Sonar does on https://sonarcloud.io/project/issues?id=io.github.jhipster.sample%3Ajhipster-sample-application&resolved=false&types=VULNERABILITY

Yes that's what we do, and in the https://sonarcloud.io/project/issues?id=io.github.jhipster.sample%3Ajhipster-sample-application&resolved=false&types=VULNERABILITY report it's currently empty, with an empty history (and they keep track for the last 30 days)

That's on every commit, this is automatically run by Travis with this script: https://github.com/jhipster/generator-jhipster/blob/v5.2.1/travis/scripts/06-sonar.sh

We use OWASP with each major release, even if the tool is pretty bad

We use JavaScript so that should be good

I'm pretty sure OWASP does this

Yes but OWASP never found anything