4 ms·
Does that help with an exec of an arbitrary string from an input? Or a database open to the internet? Or OS level security issues?
by aprdm 5y ago
Does that help with an exec of an arbitrary string from an input? Or a database open to the internet? Or OS level security issues?
- geoduck14 5y agoIt is just focused on the code in git. It finds things like: Open Source Licensing issues, library versions with KNOWN vulnerabilities, XSS, and SQL injection. It is supposed to work with a variety of languages - but I've only seen it used with a couple. For an open database to the internet, you will need completely different tools - I speculate network scanning. A bigger problem is running code that DELIBERATELY sends data to an outside source though your proxy. OS level issues should be managed by a central team that approves the version of OS and EVERYONE installed that EXACT patched OS, and refreshes quickly after patches are released.