mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-31 15:54:24 +00:00
Jon Young
7e194407f6
* chore(CI): import pre-commit-config.yaml from prowler-cloud/prowler * chore(CI): import pre-commit-config.yaml from prowler-cloud/prowler * chore(CI): add safety package to pre-commit * chore(CI): use poetry run to access venv for local checks * docs(repo): add community focused docs * chore(GitHub): add ISSUE_TEMPLATEs same as prowler-cloud/prowler repo * chore(CI): add pull-request.yml workflow runs on PRs and pushes to main * chore(CI): add additional workflows same as those on prowler-cloud/prowler * fix(CI): use correct path * fix(API): fix flake8 F401 failures * fix(API, Backend): format with black * fix( Backend): format with black * fix(CI): use correct path * fix(CI): move pyproject.toml * fix(CI): simplify tools with ruff * fix(CI): use ruff instead of flake8, black * fix(CI): change ruff commands for GHA * fix(CI): use correct ruff command name * fix(Backend): ruff format * fix(CI): ignore safety jinja2 vuln id 70612 and add mypy for future usage * fix(CI): set file path for hadolint * fix(CI): add dockle * fix(CI): update dockle version * fix(CI): fix hadolint errors * fix(CI): add simple tests for CI * fix(Docker): multi-stage docker build * docs(README): update docs for poetry location
24 lines
1.6 KiB
Markdown
24 lines
1.6 KiB
Markdown
# Security Policy
|
|
|
|
## Software Security
|
|
As an **AWS Partner** and we have passed the [AWS Foundation Technical Review (FTR)](https://aws.amazon.com/partners/foundational-technical-review/) and we use the following tools and automation to make sure our code is secure and dependencies up-to-dated:
|
|
|
|
- `bandit` for code security review.
|
|
- `safety` and `dependabot` for dependencies.
|
|
- `hadolint` and `dockle` for our containers security.
|
|
- `snyk` in Docker Hub.
|
|
- `clair` in Amazon ECR.
|
|
- `vulture`, `flake8`, `black` and `pylint` for formatting and best practices.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you would like to report a vulnerability or have a security concern regarding Prowler Open Source or ProwlerPro service, please submit the information by contacting to https://support.prowler.com.
|
|
|
|
The information you share with ProwlerPro as part of this process is kept confidential within ProwlerPro. We will only share this information with a third party if the vulnerability you report is found to affect a third-party product, in which case we will share this information with the third-party product's author or manufacturer. Otherwise, we will only share this information as permitted by you.
|
|
|
|
We will review the submitted report, and assign it a tracking number. We will then respond to you, acknowledging receipt of the report, and outline the next steps in the process.
|
|
|
|
You will receive a non-automated response to your initial contact within 24 hours, confirming receipt of your reported vulnerability.
|
|
|
|
We will coordinate public notification of any validated vulnerability with you. Where possible, we prefer that our respective public disclosures be posted simultaneously.
|