@reason.co/vunlscan

Vunlscan

v0.0.1

This is an internal Reason tool for vunl scanning.

It will generate a PDF that you can save to artifacts and then pass onto client.

Add to your pipeline

# NPM_TOKEN="MAKE SURE THIS IS IN ENV VARS" 
lasttag=$(git describe --abbrev=0 --tags) # abbrev'd - or whatever you want your version to be
whitelistpath=$(pwd)/packages/@project/componenet/audit-whitelist.json
scanpathpath=$(pwd)/packages/@project/componenet/retail-insights-app
projectname="App name here"

vunlscan --scanpath="$scanpathpath" --version="$lasttag" --whitelist="$whitelistpath" --projectname="$projectname"

What is a 'audit-whitelist.json' ?

This is a whitelist file to accept vulnerabilities.

For OSS vulnerabilities, you need to put in the ID (from output) and description (why it is whitelisted), if it needs to be hidden from the report, set "hide" to true.

For HawkEye vulnerabilities, you add a _hawk node and it's ID and description (why it is whitelisted).

If there are items (that are not hidden) in the whitelist, it will add an appendix to the report.

{
  "node": [
    {
      "id": "61538021-1545-4bc3-a154-15b7441d11c3",
      "description": "False negative captured by node environment - Set this to hide:true",
      "hide": true
    },
    ...
  ],
  "_hawk": [
    {
      "id": "files-secrets-.env-58",
      "description": "Env file does not contain any sensitive information"
    }
  ]
}
```