diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 732843f8..b267132c 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,31 +1,42 @@ --- -name: Bug report -about: Create a report to help us improve +name: "๐Ÿž Bug report" +about: Please create a bug report if you encouter any project specific issue. +labels: bug --- + **Describe the bug** -A clear and concise description of what the bug is. + **To Reproduce** + **Expected behavior** -A clear and concise description of what you expected to happen. + **System (please complete the following information):** + **Screenshots / Logs** -If applicable, add screenshots to help explain your problem. + **Additional context** -Add any other context about the problem here. + diff --git a/.github/ISSUE_TEMPLATE/documentation_issue.md b/.github/ISSUE_TEMPLATE/documentation_issue.md new file mode 100644 index 00000000..dbdca92c --- /dev/null +++ b/.github/ISSUE_TEMPLATE/documentation_issue.md @@ -0,0 +1,20 @@ +--- +name: "๐Ÿ“š Documentation Issue" +about: "Did you come across parts of our documentation that should be fixed?" +labels: documentation + +--- + + +## Where to find the issue + + +## Describe the issue + + +## Suggested change + \ No newline at end of file diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index 066b2d92..a893c739 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,17 +1,22 @@ --- -name: Feature request -about: Suggest an idea for this project +name: "โžน Feature request" +about: "Suggest an idea for this project" --- + **Is your feature request related to a problem? Please describe.** -A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + **Describe the solution you'd like** -A clear and concise description of what you want to happen. + **Describe alternatives you've considered** -A clear and concise description of any alternative solutions or features you've considered. + **Additional context** -Add any other context or screenshots about the feature request here. + diff --git a/.github/ISSUE_TEMPLATE/new_hook.md b/.github/ISSUE_TEMPLATE/new_hook.md new file mode 100644 index 00000000..af32549e --- /dev/null +++ b/.github/ISSUE_TEMPLATE/new_hook.md @@ -0,0 +1,38 @@ +--- +name: 'โš“๏ธ New Hook request' +about: 'Suggest an idea for a new data processing or integration hook in this project.' +labels: 'hook' +--- + + + +## New Hook implementation request + +**Is your feature request related to a problem? Please describe.** + + +**Describe the solution you'd like** + + +**Describe alternatives you've considered** + + +**Additional context** + + +## Steps to implement a new Hook + + +- [ ] Create a new folder with the name of the [hook here](https://github.com/secureCodeBox/secureCodeBox-v2/tree/master/hooks) +- [ ] Add a README and give a brief overview of the scanner and its configuration options. +- [ ] Add (optional) a Dockerfile for the scanner if there is no existing one publicly available on dockerHub +- [ ] Use the [Hook-SDK](https://github.com/secureCodeBox/secureCodeBox-v2/tree/master/hook-sdk) to implement a new hook (currently based on NodeJS) +- [ ] Add unit tests with at minimum 80% test coverage +- [ ] Add some example scan.yaml and finding.yaml files in the example folder +- [ ] Implement a new integration test for the hook [here](https://github.com/secureCodeBox/secureCodeBox-v2/tree/master/tests/integration) diff --git a/.github/ISSUE_TEMPLATE/new_security_scanner.md b/.github/ISSUE_TEMPLATE/new_security_scanner.md index 4209c8d8..c86a2968 100644 --- a/.github/ISSUE_TEMPLATE/new_security_scanner.md +++ b/.github/ISSUE_TEMPLATE/new_security_scanner.md @@ -1,35 +1,39 @@ --- -name: 'New Security Scanner request' +name: '๐Ÿš“ New Security Scanner request' about: 'Suggest an idea for a new security scanner to integrate in this project.' -labels: 'security scanner' +labels: 'scanner' --- + + + ## New Scanner implementation request **Is your feature request related to a problem? Please describe.** -- _A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]_ + **Describe the solution you'd like** -- _A clear and concise description of what you want to happen._ + **Describe alternatives you've considered** -- _A clear and concise description of any alternative solutions or features you've considered._ + **Additional context** -- _Add any other context or screenshots about the feature request here._ + ## Steps to implement a new scanner -> Hint: A general guide how to implement a new scanner is documented [here]( https://github.com/secureCodeBox/secureCodeBox/blob/master/docs/developer-guide/README.md#developing-own-processes) - -### Must have -- [ ] Create a [new public secureCodeBox repository](https://github.com/organizations/secureCodeBox/repositories/new) for the scanner implementation -- [ ] Implement a new scanner microservice an reuse some of the existing stuff, if possible -- [ ] Check if there is a [healthcheck](https://github.com/secureCodeBox/secureCodeBox/blob/master/docs/developer-guide/README.md#healthchecks-for-scanner-microservices) for the microservice implemented -- [ ] Implement a [new basic security process](https://github.com/secureCodeBox/secureCodeBox/blob/master/docs/developer-guide/README.md#developing-a-process-model) for the scanner -- [ ] Update the [docker-compose](https://github.com/secureCodeBox/secureCodeBox/blob/master/docker-compose.yml) files and integrate your new scanner there -- [ ] Update the [user guide](https://github.com/secureCodeBox/secureCodeBox/tree/master/docs/user-guide) and [developer guide](https://github.com/secureCodeBox/secureCodeBox/tree/master/docs/developer-guide) -- [ ] Implement a integration test for the scanner [here](https://github.com/secureCodeBox/secureCodeBox/tree/master/test) - -### Should have -- [ ] Update the [CLI examples](https://github.com/secureCodeBox/secureCodeBox/tree/master/cli) -- [ ] Update the [Jenkins Pipeline](https://github.com/secureCodeBox/integration-pipeline-jenkins-examples) examples -- [ ] Update the [OpenShift Container Setup](https://github.com/secureCodeBox/ansible-role-securecodebox-openshift) + + +- [ ] Create a new folder with the name of the [scanner here](https://github.com/secureCodeBox/secureCodeBox-v2/tree/master/scanners) +- [ ] Add a README.md and give a brief overview of the scanner and its configuration options. +- [ ] Implement a new scanner specific scan-type.yaml +- [ ] Implement a new scanner specific parse-definition.yaml +- [ ] Add (optional) some cascading-rules.yaml +- [ ] Add (optional) a Dockerfile for the scanner if there is no existing one publicly available on dockerHub +- [ ] Use the [parser-SDK](https://github.com/secureCodeBox/secureCodeBox-v2/tree/master/parser-sdk) to implement a new findings parser (currently based on NodeJS) +- [ ] Add unit tests with at minimum 80% test coverage diff --git a/.github/ISSUE_TEMPLATE/question.md b/.github/ISSUE_TEMPLATE/question.md new file mode 100644 index 00000000..aeafc6e6 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/question.md @@ -0,0 +1,14 @@ +--- +name: "๐Ÿคจ Question" +about: "If you have *specific* questions about the project, please post them here." +labels: question + +--- + + +## Your Question + \ No newline at end of file diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 00000000..75373f85 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,20 @@ + + +## Checklist + +* [ ] Test your changes as thoroughly as possible before you commit them. Preferably, automate your test by unit/integration tests. +* [ ] Make sure `npm test` runs for the whole project. + +## Description + + \ No newline at end of file diff --git a/README.md b/README.md index 9f4abab0..f14835a6 100644 --- a/README.md +++ b/README.md @@ -65,7 +65,9 @@ The typical way to ensure application security is to hire a security specialist With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. -The purpose of _secureCodeBox_ **is not** to replace the penetration testers or make them obsolete. We strongly recommend running extensive tests by experienced penetration testers on all your applications. +![secureCodeBox Architecture](./docs/resources/macbook_kibana.jpg) + +The purpose of _secureCodeBox_ **is not** to replace the penetration testers or make them obsolete. We strongly recommend to run extensive tests by experienced penetration testers on all your applications. **Important note**: The _secureCodeBox_ is no simple one-button-click-solution! You must have a deep understanding of security and how to configure the scanners. Furthermore, an understanding of the scan results and how to interpret them is also necessary. diff --git a/docs/_config.yml b/docs/_config.yml deleted file mode 100644 index 2f7efbea..00000000 --- a/docs/_config.yml +++ /dev/null @@ -1 +0,0 @@ -theme: jekyll-theme-minimal \ No newline at end of file diff --git a/docs/glossary.md b/docs/glossary.md new file mode 100644 index 00000000..ca136a44 --- /dev/null +++ b/docs/glossary.md @@ -0,0 +1,13 @@ +# Glossary + +This overview provides a description for all acronyms and special terms which are used in this project. If you encounter any missing terms, please [let us know](https://github.com/corona-warn-app/cwa-documentation/issues/new?labels=documentation%2C+bug&template=01_doc_issue.md) or [create a pull request](https://github.com/secureCodeBox/secureCodeBox-v2/pulls). + +| Term, acronym... | Description | +| --- | --- | +| API | An [Application Programming Interface](https://en.wikipedia.org/wiki/Application_programming_interface) (API) is a computing interface which defines interactions between multiple software intermediaries. | +| CRD | Acronym for "[Custom Ressource Definition](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/)". | +| GUID | Acronym for "[Globally Unique Identifier](https://en.wikipedia.org/wiki/Universally_unique_identifier)". | +| K8S | Acronym for "[Kubernetes](https://kubernetes.io/docs/home/)". | +| SCB | Acronym for "[secureCodeBox (This Project)](https://www.secureCodeBox.io)". | + + diff --git a/docs/index.md b/docs/index.md index abb1ab06..646b7123 100644 --- a/docs/index.md +++ b/docs/index.md @@ -7,14 +7,16 @@ ## Documentation Overview -- [Project Readme and Quickstart][scb-github] -- [User Guide](user-guide/README.md) -- [Developer Guide](developer-guide/README.md) +- [Project Readme and Quickstart][scb-github] Start here if you want to get a brief overview and installation quickstart +- [User Guide](user-guide/README.md) If you want to configure security automation in your environment, please take a look into our user guide. +- [Developer Guide](developer-guide/README.md) If you want to extend the project an add your own compents or bugfix something, please take a look into our developer guide. +- [Glossary](glossary.md) This overview provides a description for all acronyms and special terms which are used in this project. +- [Versioning](versioning.md) This describes how we use versioning in tags and releases. ## Need a human? -- [Join Slack][scb-slack] +- [Join us -> Slack][scb-slack] ๐Ÿ’ฌ ## License Code of secureCodeBox is licensed under the [Apache License 2.0][scb-license]. diff --git a/docs/user-guide/README.md b/docs/user-guide/README.md index c0b3a4c0..af3821b6 100644 --- a/docs/user-guide/README.md +++ b/docs/user-guide/README.md @@ -135,4 +135,4 @@ pop3s-tls-scan sslyze non-invasive light smtps-tls-scan sslyze non-invasive light ssh-scan ssh-scan non-invasive light zap-http zap-baseline non-invasive medium -``` \ No newline at end of file +``` diff --git a/docs/versioning.md b/docs/versioning.md new file mode 100644 index 00000000..0bfe605b --- /dev/null +++ b/docs/versioning.md @@ -0,0 +1,17 @@ +# Versioning + +All components of the secureCodeBox use [Semantic versioning](https://semver.org/). + +Given a version number MAJOR.MINOR.PATCH, we increment the: + +- MAJOR version when we make incompatible API changes, +- MINOR version when we add functionality in a backwards compatible manner, and +- PATCH version when we make backwards compatible bug fixes. + +## Maintaining compatible versions + +Backend components will always remain compatible due to ongoing the availability of old API versions. + +## Changelogs + +Changelogs can be found the in release notes attached to git tags, e.g. (https://github.com/secureCodeBox/secureCodeBox-v2/releases). \ No newline at end of file