victoria

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Interim versions are released between major versions: https://github.com/glasswall-sre/victoria/releases

Repository on GitHub, which uses git. git is distributed.

Semantic versioning is used for release numbers: https://github.com/glasswall-sre/victoria/releases

https://github.com/glasswall-sre/victoria/releases

Release notes are found on every release: https://github.com/glasswall-sre/victoria/releases

As of yet there have been no publicly known vulnerabilities.

GitHub issue tracker is used, with a bug report issue template: https://github.com/glasswall-sre/victoria/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5BBUG%5D+%7BDescription+of+issue%7D

GitHub issue tracker is used.

No bug reports have yet been submitted, but we do have the capacity to acknowledge all bug reports as they occur.

No enhancements have yet been submitted, but we do have the capacity to acknowledge all bug reports as they occur.

GitHub is used as an issue tracker and version control system: https://github.com/glasswall-sre/victoria/issues

The process for reporting a vulnerability is detailed in the documentation: https://sre.glasswallsolutions.com/victoria/index.html#vulnerability-reports

This is detailed in the vulnerability reporting section of the documentation, emails can be sent to a secure email address: https://sre.glasswallsolutions.com/victoria/index.html#vulnerability-reports

No vulnerabilities have yet been reported, however in the documentation we agree to acknowledge all reports within one business day: https://sre.glasswallsolutions.com/victoria/index.html#vulnerability-reports

Python setuptools is used for this. The project can be built using Twine and the project's setup.py. The project also has CI/CD builds which can be run to build and distribute the software.

Python setuptools is used for this. The project can be built using Twine and the project's setup.py.

Python setuptools is used for this. The project can be built using Twine and the project's setup.py.

The project is tested using pytest, with 91% test coverage.

The project can be tested by running pytest in the project root folder, which is standard.

The project has 91% test coverage.

The project has a CI build that tests the code, lints the code, and scans for vulnerabilities. Additionally it uses SonarCloud as a static analysis system. This happens for every pull request.

Codecov is used to ensure new code added in a PR has a test coverage of at least 80%, also specified in the pull request guide: https://sre.glasswallsolutions.com/victoria/index.html#pull-requests

Coverage history can be viewed on codecov: https://codecov.io/gh/glasswall-sre/victoria

Specified in the pull request guide: https://sre.glasswallsolutions.com/victoria/index.html#pull-requests

The project uses pylint with warnings enabled. Pull requests are gated by a successful pylint execution.

Pull requests are gated by a successful pylint execution.

The project uses pylint with all warnings enabled.

I am the primary developer - I have a first class degree in Computer Science, and I have been working as a Software Engineer in the cyber security field for 2 years now.

I have had experience with addressing/mitigating these kinds of errors in my 2 years experience as a Software Engineer in the cyber security field.

Victoria uses envelope encryption to encrypt secure data in plugin config files. The key encryption key comes from a secure cloud encryption service (at the moment, only Azure Key Vault is supported), and the data encryption keys are generated according to Google's best practices guide. This means they use a 256-bit AES cipher in Galois Counter Mode, with a 96-bit nonce length (as recommended by NIST for AES in GCM). Keys and nonces are not reused, ever. This information can be found in the documentation: https://sre.glasswallsolutions.com/victoria/autoapi/victoria/encryption/provider/index.html#victoria.encryption.provider.EncryptionProvider._data_encrypt

Victoria uses cloud encryption providers and the Python cryptography library: https://cryptography.io/en/latest/

Uses the open-source Python cryptography library: https://github.com/pyca/cryptography

Uses a 256-bit AES cipher in Galois Counter Mode, with a 96-bit nonce length (as recommended by NIST for AES in GCM).

Uses a 256-bit AES cipher in Galois Counter Mode, with a 96-bit nonce length (as recommended by NIST for AES in GCM).

Uses a 256-bit AES cipher in Galois Counter Mode, with a 96-bit nonce length (as recommended by NIST for AES in GCM).

Uses envelope encryption. Data encryption keys and nonces are never reused, and key encryption keys come from a cloud provider, and key rotation is supported.

No passwords are stored.

Uses open-source Python cryptography library to generate data encryption keys securely: https://github.com/pyca/cryptography Generates nonces using Python standard library os.urandom, which is a cryptographically-secure random number generator: https://github.com/glasswall-sre/victoria/blob/master/victoria/encryption/provider.py#L131

Project uses HTTPS.

Project uses HTTPS.

As of yet there are no vulnerabilities.

As of yet there are no vulnerabilities.

The project has not ever leaked any private credentials.

Pylint is used to check for warnings. SonarCloud is also used: https://sonarcloud.io/dashboard?id=victoria

SonarCloud is used to check for vulnerabilities: https://sonarcloud.io/dashboard?id=victoria

No vulnerabilities have been found.

Static code analysis occurs on pull requests into master. No code can be merged unless static analysis comes back with no issues.

We use Bandit in CI builds to check for vulnerabilties: https://pypi.org/project/bandit/

The project does not produce software written in a memory-unsafe language.

No vulnerabilities have been found.