Skip to content
Permalink
Browse files

Linting

  • Loading branch information...
aaronweaver committed Mar 20, 2019
1 parent 17ec283 commit f5d6cc6be41b5fa45c77d3aa686cf4027c030e8f
Showing with 35 additions and 337 deletions.
  1. +3 −3 DOCKER.md
  2. +5 −4 KUBERNETES.md
  3. +1 −1 LICENSE.md
  4. +20 −16 SECURITY.md
  5. +0 −311 index.html
  6. +6 −2 travis/README.md
@@ -1,10 +1,10 @@
## Run with Docker Compose
# Run with Docker Compose

Docker compose is not intended for production use.
If you want to deploy a containerized DefectDojo to a production environment,
use the [Helm and Kubernetes](KUBERNETES.md) approach.

### Setup via Docker Compose
## Setup via Docker Compose

If you start your DefectDojo instance on Docker Compose for the first time, just
run `docker-compose up`.
@@ -17,7 +17,7 @@ If you ran DefectDojo with compose before and you want to prevent the
initializer container from running again, define an environment variable
DD_INITIALIZE=false to prevent re-initialization.

## Build Images Locally
### Build Images Locally

Build the docker containers locally for testing purposes.

@@ -9,9 +9,10 @@ For development purposes,
and [Helm](https://helm.sh/) can be installed locally by following
this [guide](https://helm.sh/docs/using_helm/#installing-helm).

# Kubernetes Local Quickstart
## Kubernetes Local Quickstart

Requirements:

1. Helm installed locally
2. Minikube installed locally
3. Latest cloned copy of DefectDojo
@@ -71,7 +72,7 @@ echo "DefectDojo admin password: $(kubectl \
To access DefectDojo, go to <http://defectdojo.default.minikube.local:8080>.
Log in with username admin and the password from the previous command.

# Minikube with locally built containers
### Minikube with locally built containers

If testing containers locally, then set the imagePullPolicy to Never,
which ensures containers are not pulled from Docker hub.
@@ -84,15 +85,15 @@ helm install \
--set imagePullPolicy=Never
```

## Build Images Locally
### Build Images Locally

```zsh
# Build images
docker build -t defectdojo/defectdojo-django -f Dockerfile.django .
docker build -t defectdojo/defectdojo-nginx -f Dockerfile.nginx .
```

# Kubernetes Production
## Kubernetes Production

Optionally, for TLS locally, you need to install a TLS certificate into your
Kubernetes cluster.
@@ -1,4 +1,4 @@
Copyright (c) 2015, DefectDojo Maintainers, All rights reserved.
# Copyright (c) 2015, DefectDojo Maintainers, All rights reserved

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

@@ -1,20 +1,24 @@
# Security

No technology is perfect, and OWASP DefectDojo believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue in our product, we encourage you to notify us. We welcome working with you to resolve the issue promptly.

# Disclosure Policy
* Let us know by submitting the finding through HackerOne's [disclosure submission program](https://hackerone.com/defectdojo/reports/new) as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
* Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

# Exclusions
While researching, we'd like to ask you to refrain from:
* Denial of service
* Spamming
* Social engineering (including phishing) of DefectDojo staff or contractors
* Any physical attempts against DefectDojo property or cloud hosted environments

# Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
No technology is perfect, and OWASP DefectDojo believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue in our product, we encourage you to notify us. We welcome working with you to resolve the issue promptly.

## Disclosure Policy

* Let us know by submitting the finding through HackerOne's [disclosure submission program](https://hackerone.com/defectdojo/reports/new) as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
* Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

## Exclusions

While researching, we'd like to ask you to refrain from:

* Denial of service
* Spamming
* Social engineering (including phishing) of DefectDojo staff or contractors
* Any physical attempts against DefectDojo property or cloud hosted environments

## Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep DefectDojo and our users safe!

0 comments on commit f5d6cc6

Please sign in to comment.
You can’t perform that action at this time.