Repository navigation
Security Boundaries and Troubleshooting
- No built-in TLS: the API serves HTTP. Use a trusted reverse proxy for TLS and network access control.
- Authentication: non-loopback API binds require a configured SHA-256 bearer-token digest.
- Webhook notifier: monitor webhooks require HTTPS destinations and are signed with the shared integration HMAC scheme; secrets resolve from named environment variables and never appear in errors or logs.
- Focused SAST: rules are syntax-aware and language-scoped, but Hooray is not a compiler-complete interprocedural data-flow engine.
- Malware: exact digest matching requires an externally supplied signature set. The CLI does not ship an active malware feed by default.
- License analysis: detection is evidence, not legal advice.
- Containers: Hooray analyzes archive/layout content; it does not execute images or inspect a live runtime.
- Symlinks: Linux/Android file reads use atomic no-follow opens. Other platforms use the strongest portable checks available but cannot provide identical kernel semantics.
- IaC locations: structured Kubernetes and CloudFormation findings are object-aware, but lightweight source anchoring is not a full parser-span engine.
The default policy path is hooray-policy.yaml. Supply one with --policy, change policy_path, or create the file before scanning.
Set offline: true or HOORAY_OFFLINE=true. Offline mode still performs local scanners, policy, reporting, and persistence.
Configure auth_bearer_sha256 with a valid lowercase SHA-256 digest before binding beyond loopback.
Check traversal/link entries, member count, cumulative expanded bytes, manifest digests, and configured max_archive_bytes/max_archive_entries. OCI limits span all layers, including whiteouts and overwrites.
All renderers stop at 64 MiB. Narrow findings, select a streaming-friendly format such as json-lines, or retain the canonical run in SQLite and query subsets.
Register targets with hooray monitor targets add TARGET_ID --source SOURCE --interval-seconds SECONDS and check due state with monitor targets list. Verify webhook delivery reaches an HTTPS endpoint with a resolvable, non-empty secret environment variable when --webhook-url/--webhook-secret-env are set. Inspect persisted retry/dead-letter state and notifier errors.
Check fail-closed settings for unknown applicability/licenses, rule priority, exact exception selectors, expiration, and asset-compatible baseline selection.
Do not include secrets, production databases, tokens, or unredacted customer reports in public issues. Provide the minimum reproducible input and affected version.