To evaluate the tools/findings, we need should compare it with our current environment:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T382500 [EPIC] Select and Tune Security Tools for Universal Security Dashboard | |||
| In Progress | None | T382536 Set up and automate scanning tool evaluation pipeline |
limited to just extensions for now
I'd suggest further limiting this to just Wikimedia production-deployed extensions, for now.
To be extended to Phan and LibUp
It might be easiest to just compare these to phan/security-check and libup runs in gerrit CI for various repos, either on real change sets or synthetic ones. Setting this up locally, especially for libup, would likely be a heavy lift.
Ingest the data into DefectDojo via REST API
Not sure how easy DefectDojo can automate a lot of this, but I'd imagine that with base semgrep and osv-scanner runs, there would be a heavy amount of false positives with these tools. Without more tuned/custom semgrep rules and vulnerability analysis, I'm not certain how meaningful this analysis might be.
Removing inactive assignee account. (Please do so as part of your team's offboarding process.)