Comments (3)
Am I correct in assuming that a higher security level means more checks will be run?
No, the same amount of checks are done. The -security
switch will make insider to fail if your score is below that value, and suceed when above. This allows you to use insider in your CI/CD pipeline and ensure the score of your application never gets below that threshold. This provides a guarantee of a certain level of security in your application.
So I should be running with -security 100?
Probably not. Using -security 100
means any low vulnerability will fail your build. You probably want to allow a few low ones to pass and have them bashed in a subsequent release. For instance I just scanned one of my apps and it yields a score of 80/100 with 4 low vulnerabilities. A threshold of 60~80 looks like a decent value for that parameter, depending on your security expectations.
The value you'll want to use exactly is hard to tell, because it depends on the threat model you're facing, as well as the security expectations for the application and the surrounding systems it operates within. Also scoring is not a perfect technique, as it relies on the idea that you can set a definitive relative score for each type of vulnerability, which is not always true.
If you can afford a better AST process, it's good for first screening vulnerable applications though
from insider.
Thanks for the information! So for clarification, if I don't pass in that parameter at all, it just gives me the results?
from insider.
if I don't pass in that parameter at all, it just gives me the results?
Correct
from insider.
Related Issues (20)
- 0 vulnerabilities reported for iGoat-Swift HOT 7
- 0 vulnerabilities found in Android library project HOT 4
- NewInputFile throws an unhandled exception, with both javascript and C# HOT 2
- Skip files based on pattern HOT 2
- More information about -exclude HOT 2
- Insider 3.0.0 Hung on macOS when running analysis on JS application HOT 1
- html report is not getting generated HOT 5
- How To Install It On Macbook HOT 1
- Add a per-directory config file
- docker version report is stored in the image HOT 2
- Add tool/scan metadata to .json results file
- iOS Code Scan issue
- Option to define custom reports Path and Name
- Severity is blank in the report HOT 1
- SVG path in React component is detected and constants as hard coded credentials HOT 1
- Install from Source Instructions Need Update HOT 1
- Ability to scan from gradle project
- Unable to install Insider CLI software in Windows 10
- insider for ARM based computers HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from insider.