isxbot / software-assurance Goto Github PK

Create the diagrams as they apply to our scenarios.

Create a proposal stub that outlines the proposal.

Create a markdown document with the outline of our deliverable (e.g., code review strategy, automated scanning results, manual results).

Findings from manual code review of critical security functions identified in misuse cases, assurance cases and threat models.

• Starting review of all hotspots except 'Prohibit weak randoms', which Sam is reviewing.
• Finished reviewing the following hotspots:
  • Subprocess popen with shell equals true
  • Hardcoded tmp directory
  • Prohibited unencrypted sockets
  • Subprocess without shell equals true
  • Prevent path traversal
• Added manual code review findings to SCA.md, created PR.

A short summary of your code review strategy. What challenges did you anticipate and how did your code review strategy attempt to address those challenges?

• A short summary of our review strategy has been added to the document stub.

• Scanning by Codacy has been completed.
• An overview of the results has been added to the document stub.

Summary of key findings from manual and/or automated scanning. This summary may include categorization, mappings to CWEs, CAPECs, Risk Levels, etc.

Create a branch for each team member, so we're not all working on master.

Use the master branch for finished products only. Submit pull requests from each of our branches, so the team can review before merging to the master branch.