/huskyCI

Performing security tests inside your CI

Primary LanguageGoBSD 3-Clause "New" or "Revised" LicenseBSD-3-Clause

This article can also be read in Brazilian Portuguese.

Introduction

huskyCI is an open source tool that orchestrates security tests and centralizes all results into a database for further analysis and metrics. It can perform static security analysis in Python (Bandit and Safety), Ruby (Brakeman), JavaScript (Npm Audit and Yarn Audit), Golang (Gosec), Java (SpotBugs plus Find Sec Bugs), and HCL (TFSec). It can also audit repositories for secrets like AWS Secret Keys, Private SSH Keys, and many others using GitLeaks.

How does it work?

Developers can set up a new stage into their CI pipelines to check for vulnerabilities:

If security issues are found in the code, the severity, the confidence, the file, the line, and many more useful information can be shown, as exemplified:

[HUSKYCI][*] poc-python-bandit -> https://github.com/globocom/huskyCI.git
[HUSKYCI][*] huskyCI analysis started! yDS9tb9mdt4QnnyvOBp3eVAXE1nWpTRQ

[HUSKYCI][!] Title: Use of exec detected.
[HUSKYCI][!] Language: Python
[HUSKYCI][!] Tool: Bandit
[HUSKYCI][!] Severity: MEDIUM
[HUSKYCI][!] Confidence: HIGH
[HUSKYCI][!] Details: Use of exec detected.
[HUSKYCI][!] File: ./main.py
[HUSKYCI][!] Line: 7
[HUSKYCI][!] Code:
6
7 exec(command)
8

[HUSKYCI][!] Title: Possible hardcoded password: 'password123!'
[HUSKYCI][!] Language: Python
[HUSKYCI][!] Tool: Bandit
[HUSKYCI][!] Severity: LOW
[HUSKYCI][!] Confidence: MEDIUM
[HUSKYCI][!] Details: Possible hardcoded password: 'password123!'
[HUSKYCI][!] File: ./main.py
[HUSKYCI][!] Line: 1
[HUSKYCI][!] Code:
1 secret = 'password123!'
2
3 password = 'thisisnotapassword' #nohusky
4

[HUSKYCI][SUMMARY] Python -> huskyci/bandit:1.6.2
[HUSKYCI][SUMMARY] High: 0
[HUSKYCI][SUMMARY] Medium: 1
[HUSKYCI][SUMMARY] Low: 1
[HUSKYCI][SUMMARY] NoSecHusky: 1

[HUSKYCI][SUMMARY] Total
[HUSKYCI][SUMMARY] High: 0
[HUSKYCI][SUMMARY] Medium: 1
[HUSKYCI][SUMMARY] Low: 1
[HUSKYCI][SUMMARY] NoSecHusky: 1

[HUSKYCI][*] The following securityTests were executed and no blocking vulnerabilities were found:
[HUSKYCI][*] [huskyci/gitleaks:2.1.0]
[HUSKYCI][*] Some HIGH/MEDIUM issues were found in these securityTests:
[HUSKYCI][*] [huskyci/bandit:1.6.2]
ERROR: Job failed: exit code 190

Getting Started

You can try huskyCI by setting up a local environment using Docker Compose following this guide.

Documentation

All guides and the full documentation can be found in the official documentation page.

Contributing

Read our contributing guide to learn about our development process, how to propose bugfixes and improvements, and how to build and test your changes to huskyCI.

Communication

We have a few channels for contact, feel free to reach out to us at:

Contributors


rafaveira3

Krlier

spimpaov

joserenatosilva

gabriel-cantergiani

marcelomagina

nettoclaudio

edersonbrilhante

GabhenDM

mdjunior

fguisso

vitoriario

rodrigo-brito

gustavocovas

abzcoding

lzakharov

itepifanio

victorpalmeira

meltedblocks

localleon

jimmy1134

henriquebonadio-zz

vfiebig

gitter-badger

renatoaquino

RayTdC

rafaelrubbioli

rafaelsq

ragoso

aranhams

This project exists thanks to all the contributors. You rock! ❤️🚀

License

huskyCI is licensed under the BSD 3-Clause "New" or "Revised" License.