Precaution - Your Source… for Vulnerabilities

No ratings

Presented at BSidesBudapest 2019 by

Precaution is an open source GitHub app designed to increase the security of open source projects by automatically scanning new pull requests for security vulnerabilities. The analysis reports issues such as weak cryptography, potential issues in certificate handling or possible publication of secrets and passwords and many others. Right now, we support scanning code in Python (using Bandit) and Go (using Gosec) but additional languages may be added in the future. In the talk I will present the Precaution’s workflow - how does it interacts with GitHub, the analysis the code for security vulnerabilities, the way Precaution merges the output from multiple security linters and how the results from the analysis are shown in the pull request itself on GitHub. I plan to record short video of how to use Precaution.