69

Unfortunately, you are the ones responsible of seeing if your threat model is justified or not. Therefore, we cannot simply give a definite "yes" whether we see using the platform as a security threat or not. However, there are two points that I'd like to expand on: You seem to be extremely worried about the source code containing vulnerabilities and that ...


23

@Simon has already provided a fantastic answer, but I'd like to add in response to this point: there is no possible real warranty that staff from Gitlab cannot investigate the source and find security holes or some sensitive configuration Configuration does not belong in the repository. Configuration should be combined with code at deployment, not ...


7

As a pentester, I generally call out username enumeration as a very low or informational issue, but this can vary based on the application I'm looking at. Things that factor into how big an issue username enum really is: Authentication lockout enforced at the IP level. If you can only try a couple passwords before getting locked out, password guessing ...


5

There are multiple options except for Gitlab (including pure Git). Gitlab is an open-source/open code project so that you can install it on your private server, so nobody except your team have access. Which, raises, I believe, more prominent issue - your staff know security holes or some sensitive configuration and could sell the source code to some third ...


4

Run a tool such as GitRob or truffleHog to find sensitive information in your repositories and then use BFG to remove the data from your GIT history. Replace all passwords listed in a file (prefix lines 'regex:' or 'glob:' if required) with ***REMOVED*** wherever they occur in your repository: $ bfg --replace-text passwords.txt my-repo.git That all ...


3

Because you are talking to a manager talk to them in terms that make sense to their world - costs. Linting stops mistakes being made earlier speeding up the release process as well as reducing costs. In terms of securing a product some linter's provide rules for detecting common security mistakes that say a junior developer may not be aware of. You can ...


2

I know, the md5 of password + salt is stored in the first 32 bytes of the enrypted file now. This is not true. It will only write the 8 byte salt and nothing derived from the password (not MD5, not something else) as you claim. Instead the salt and the password will be used together to derive the encryption key using MD5, but the user needs to provide the ...


2

As the Travis CI documentation on encrypted environment variables notes: Encrypted environment variables are not available to pull requests from forks due to the security risk of exposing such information to unknown code. [...] Encryption and decryption keys are tied to the repository. If you fork a project and add it to Travis CI, it will not ...


2

When you hire someone, you do so because you expect that they provide value to your company. What are your expectations for your Application Security Engineer? If you answered "To make our product more secure", then it seems to me that you have not really thought too much about security. Perhaps it's also not your area of expertise, which is fine too. We ...


2

Can I use the employee's password itself as the key? No. They won't be able to change their password without reencrypting all data and a password is usually a weak encryption key. First derive a secure hash from the password (e.g. using PBKDF2, Argon2 or a similar Key derivation function), then generate a secure encryption key from a good random source. ...


1

For sanitization, You can refer here https://stackoverflow.com/questions/42657352/how-can-i-stop-command-injection-when-using-shell-exec-in-php7 TL;DR: Use escapeshellcmd for escaping full command to be executed, or escapeshellarg to escape arguments only for given command.


1

It definitely sounds like you could get clarity on a the task. But if that's all you have, I would start here: https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet These are the 10 most common vulnerabilities for web applications. I would suggest going through each one following the instructions for checking whether they exist and steps to remediate ...


1

Automated secure code review can be done at anytime, it just might fail on incomplete or broken code. I like my code reviews like I like my vulnerability scans from Qualys. As often as possible without disrupting the business (everyday high risk assets, entire business on weekends). Every commit should drive an automated review IMO, and a failure should ...


1

Why not use a private gitlab instance, this would alleviate any of your concerns! If your platform is to reach millions of users you could at least have a $5 a month cloud instance to run this on. But your concern comes from employees/ admins of SaaS platforms you use having ultimate access to your platforms, this would be true of any cloud service ...


1

As I said in a comment - we don't do review of arbitrary third-party API's here. But given that the site claims to provide an API for easy integration of password-less logins I find it worth to take a closer look. The problem is that there are no real technical information on this site on how this works. I've tried there small demo and found that it works ...


1

Yes I think there are "secure" ways. I think also in relation with your question that your objective can be both to avoid Command Injection and/or not triggering alerts in static source code scanners? The second one could be tricky, since the high amount of false positives these scanners generate. I honestly think that the first alert of "Firebug" could be ...


1

I'm not really familiar with Java but I've seen the same problem with other languages. The issue is that when exec is called with a string the OS shell need to be involved it needs to parse the command string into the command and arguments. Although this is not done by letting the OS shell do the splitting as in many other languages like Perl (thanks for ...


1

You should tell your manager the one of lint purposes is security by definition. For example, in Android development, that's exactly what is stated in the official documentation. I would show him this and explain that lint is a standard practice for preventing some of security issues from happening. Source


Only top voted, non community-wiki answers of a minimum length are eligible