Jon Young
7e194407f6
* chore(CI): import pre-commit-config.yaml from prowler-cloud/prowler * chore(CI): import pre-commit-config.yaml from prowler-cloud/prowler * chore(CI): add safety package to pre-commit * chore(CI): use poetry run to access venv for local checks * docs(repo): add community focused docs * chore(GitHub): add ISSUE_TEMPLATEs same as prowler-cloud/prowler repo * chore(CI): add pull-request.yml workflow runs on PRs and pushes to main * chore(CI): add additional workflows same as those on prowler-cloud/prowler * fix(CI): use correct path * fix(API): fix flake8 F401 failures * fix(API, Backend): format with black * fix( Backend): format with black * fix(CI): use correct path * fix(CI): move pyproject.toml * fix(CI): simplify tools with ruff * fix(CI): use ruff instead of flake8, black * fix(CI): change ruff commands for GHA * fix(CI): use correct ruff command name * fix(Backend): ruff format * fix(CI): ignore safety jinja2 vuln id 70612 and add mypy for future usage * fix(CI): set file path for hadolint * fix(CI): add dockle * fix(CI): update dockle version * fix(CI): fix hadolint errors * fix(CI): add simple tests for CI * fix(Docker): multi-stage docker build * docs(README): update docs for poetry location
1.6 KiB
Security Policy
Software Security
As an AWS Partner and we have passed the AWS Foundation Technical Review (FTR) and we use the following tools and automation to make sure our code is secure and dependencies up-to-dated:
banditfor code security review.safetyanddependabotfor dependencies.hadolintanddocklefor our containers security.snykin Docker Hub.clairin Amazon ECR.vulture,flake8,blackandpylintfor formatting and best practices.
Reporting a Vulnerability
If you would like to report a vulnerability or have a security concern regarding Prowler Open Source or ProwlerPro service, please submit the information by contacting to https://support.prowler.com.
The information you share with ProwlerPro as part of this process is kept confidential within ProwlerPro. We will only share this information with a third party if the vulnerability you report is found to affect a third-party product, in which case we will share this information with the third-party product's author or manufacturer. Otherwise, we will only share this information as permitted by you.
We will review the submitted report, and assign it a tracking number. We will then respond to you, acknowledging receipt of the report, and outline the next steps in the process.
You will receive a non-automated response to your initial contact within 24 hours, confirming receipt of your reported vulnerability.
We will coordinate public notification of any validated vulnerability with you. Where possible, we prefer that our respective public disclosures be posted simultaneously.