OWASP Juice Shop

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Repository on GitHub, which provides Pull Request and distrinct branches for non-final releases.

Repository on GitHub, which uses git. git is distributed.

Project follows Semantic Versioning pattern.

Releases are based on signed git Tags: https://github.com/juice-shop/juice-shop/releases

Release notes are available on GitHub: https://github.com/juice-shop/juice-shop/releases

The project is about being intentionally vulnerable in various ways.

Bugs can be submitted on GitHub: https://github.com/juice-shop/juice-shop/issues

Issues are tracked on GitHub: https://github.com/juice-shop/juice-shop/issues

All submitted bugs are acknowledged and fixed timely: https://github.com/juice-shop/juice-shop/issues

All submitted enhancement requests are acknowledged and fixed timely: https://github.com/juice-shop/juice-shop/issues

All issues are archived on GitHub: https://github.com/juice-shop/juice-shop/issues

Process for submitting security vulnerabilities (which are not part of any intentional hacking challenge) is defined: https://github.com/juice-shop/juice-shop/blob/master/SECURITY.md

Submission via email to project leader is prefered and PGP key for encryption is offered: https://github.com/juice-shop/juice-shop/blob/master/SECURITY.md

Build from source is available and documented: https://github.com/juice-shop/juice-shop#from-sources

Project uses npm and grunt to build from source.

All tools (including npm and grunt) used in the project are FLOSS.

Automated test suites (unit, integration, end-to-end, smoke) are all part of the project: https://github.com/juice-shop/juice-shop/tree/master/test

All test suites are executable via documented npm scripts: https://pwning.owasp-juice.shop/part3/contribution.html#testing

Execution of full test suite for all branches and PRs is performed via CI/CD pipeline: https://github.com/juice-shop/juice-shop/actions/workflows/ci.yml

CI/CD Pipeline: https://github.com/juice-shop/juice-shop/actions/workflows/ci.yml

Part of contribution guidelines: https://github.com/juice-shop/juice-shop/blob/master/CONTRIBUTING.md

Code coverage report: https://codeclimate.com/github/juice-shop/juice-shop

Part of contribution guidelines: https://github.com/juice-shop/juice-shop/blob/master/CONTRIBUTING.md

Compliance with the Javascript Standard Style Guide-based ESLint ruleset is mandated: https://github.com/juice-shop/juice-shop/blob/master/CONTRIBUTING.md

Compliance with the JavaScript Standard Style Guide-based ESLint ruleset is enforced by the CI/CD pipeline which will not pass unless zero warnings exist: https://pwning.owasp-juice.shop/part3/contribution.html#linting

The JavaScript Standard Style Guide is enforced with a zero warnings policy.

OWASP Juice Shop uses outdated and broken cryptography for some of its hacking challenges. No cryptographic mechanisms are used otherwise.

OWASP Juice Shop uses outdated and broken cryptography for some of its hacking challenges. No cryptographic mechanisms are used otherwise.

OWASP Juice Shop uses outdated and broken cryptography for some of its hacking challenges. No cryptographic mechanisms are used otherwise.

OWASP Juice Shop uses outdated and broken cryptography for some of its hacking challenges. No cryptographic mechanisms are used otherwise.

OWASP Juice Shop uses outdated and broken cryptography for some of its hacking challenges. No cryptographic mechanisms are used otherwise.

OWASP Juice Shop uses outdated and broken cryptography for some of its hacking challenges intentionally. Only the CTF flag codes are created using an actually safe HMAC with sha256. No cryptographic mechanisms are used otherwise for serious purposes.

OWASP Juice Shop uses outdated and broken cryptography for some of its hacking challenges. No cryptographic mechanisms are used otherwise.

OWASP Juice Shop uses outdated and broken cryptography for some of its hacking challenges. No cryptographic mechanisms are used otherwise.

OWASP Juice Shop uses outdated and broken cryptography for some of its hacking challenges. No cryptographic mechanisms are used otherwise.

Vulnerabilities which are not part of any hacking challenge are fixed in less than 60 days.

Secrets like API keys or user tokens for 3rd party services used during the CI/CD pipeline are stored as safely encrypted GitHub Secrets.

CodeClimate is used for static code analysis: https://codeclimate.com/github/juice-shop/juice-shop

GitHub (https://github.com/juice-shop/juice-shop/network/alerts) scans with Dependabot for known vulnerable components being used as a software dependency.

Unintentional vulnerabilities are fixed timely or might be converted into a hacking challenge.

CodeClimate is triggered continuously by the CI/CD pipeline.

The nature of OWASP Juice Shop as a vulnerable web application makes it an ideal target for DAST tools. Findings which are part of a hacking challenge will obviously not be fixed. The project used a weekly OWASP ZAP Baseline Scan (https://github.com/juice-shop/juice-shop/actions/workflows/zap_scan.yml) to find unintended vulnerabilities.

Not relevant for JavaScript project.

Due to its nature the Juice Shop only contains solution checks for all of its intentional hacking challenges.