ex-security-advisory/api

:warning: Elixir Security Advisory API

ElixirSecurityAdvisory API

This repository is not yet ready for production, check back later.

Development Usage

1. Set Environment Variable GITHUB_ACCESS_TOKEN to a valid access token
2. Create mnesia db files with the command mix amnesia.create -d ElixirSecurityAdvisory.Vulnerabilities.Database --disk
3. Start Server with iex -S mix phx.server

api's Issues

Use new UUID for Vulnerability Identification

As discussed in #1 (comment)

Hosting

Hosting is needed for the API as soon as it is ready. Someone like Gigalixir could potentially be interested to sponsor this.

Style HTML Pages

Make the HTML pages look nice & explain what the project is doing. Point users to the coming #3 cli client and to the advisory git repo to submit new vulnerabilities.

Mention Gigalixir that provides the hosting and AppSignal for the monitoring in Footer & README.

Improve Test Coverage

CLI Client

Provide a CLI client to audit the current mix.lock for vulnerabilities.

JSON API compatibility Rest

As discussed on #1 (comment)

Domain

Think about a good name & Domain for this project.

Default Pagination Parameters (REST only)

As discussed in #1 (comment)

Implement WebHooks

• Authentication via GitHub
• Webhook Management Interface
• Store WebHooks in Postgres
• Use https://github.com/camirmas/grapple for WebHook calling

Webhook Types (only generic, none for specific vulnerability / package):

• New Vulnerability
• New Package
• Vulnerability Change

Redirect all Domains to default Domain

Default Domain: https://elixiradvisories.org/

Redirects:

• https://www.elixiradvisories.org/
• https://elixiradvisories.com/
• https://www.elixiradvisories.com/

Also redirect non-tls to tls.

Test Subscriptions

Currently the subscription tests are failing often. THis needs to be solved and the subscriptions tested properly.

Scope

This ticket is supposed to be the base for the discussion of the scope of V1. Please write here if you've questions/ideas/improvements.