docs: add the Open Source Friday demo project and run of show - #1104
Merged
Conversation
CVE Lite CLI is featured on GitHub's Open Source Friday livestream on 2026-09-18. The demo is the centrepiece of that session, so it needs a project that is versioned and reproducible rather than assembled in a scratch directory on the day. shipping-api is a small Express service with five direct dependencies pinned to old versions. It produces 11 vulnerable packages, 1 critical and 6 high, split 5 direct and 6 transitive, and every one of the six transitive findings traces back to a single parent. That last property is what makes the demo land: one express upgrade resolves six findings in packages the developer never installed and could not upgrade directly. Purpose-built rather than a real repository, because scanning someone else's project live on GitHub's own channel broadcasts their vulnerabilities on a stream they did not agree to. Juice Shop was considered and rejected: 52 findings but zero direct, so there is no copy-and-run fix command to show. The README records two things found during preparation. Fix versions move between runs on live OSV data, so the commands must come from a rehearsal immediately before going live. And --offline must not be used on air: it disables registry-validated fix versions and parent-version upgrades, which are two of the four beats and the two that differentiate the tool. Verified that self-scan reads the root lockfile and does not descend into examples/, so adding a deliberately vulnerable project does not affect CI. Closes #1103
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…rvice CodeQL flagged two real issues in the demo source: a critical js/request-forgery from interpolating a route parameter into an outbound axios URL, and a high js/missing-rate-limiting on a route that performs authorization. Both were genuine. The point of this project is vulnerable dependencies, not vulnerable code, and it is committed to an OWASP repository where it gets scanned like everything else. The carrier lookup now targets a fixed host with the shipment id passed as an encoded query parameter, so the request target cannot be influenced by user input, and the id is validated against a strict pattern before any work happens. Authorization failures are handled rather than throwing. A comment records why the file must stay clean. Scan output is unchanged: 11 packages, 1 critical, 6 high, 5 direct and 6 transitive.
CodeQL still flagged js/missing-rate-limiting: the route performed JWT verification, and a route that authorizes should be rate limited. Adding a rate-limiter would mean adding a dependency, which changes the demo's finding counts, and the demo depends on those counts being stable. The scan reads package-lock.json rather than this file, so the source exists for realism and for import-based reachability only. Restructured as a worker: token verification happens once at startup against an environment variable, shipment polling is a plain function called by a scheduler, and the only route is an unauthenticated liveness probe. Scan output unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
examples/open-source-friday-demo/for the GitHub Open Source Friday livestream on 18 September.shipping-apiis a small Express service with five direct dependencies pinned to old versions. It produces 11 vulnerable packages, 1 critical and 6 high, split 5 direct and 6 transitive, and all six transitive findings trace back to a single parent. That is what makes the demo work: onenpm install express@...resolves six findings in packages the developer never installed and could not upgrade directly.Purpose-built rather than a real repository, because scanning someone else's project live on GitHub's own channel broadcasts their vulnerabilities on a stream they did not agree to. Juice Shop was considered and rejected: it produces 52 findings but zero direct, so there is no copy-and-run fix command to demonstrate.
The README carries the four-beat run of show plus two things found the hard way during preparation. Fix versions move between runs on live OSV data, so the commands have to come from a rehearsal immediately before going live rather than being prepared in advance. And
--offlinemust not be used on air: it disables registry-validated fix versions and parent-version upgrades, which are two of the four beats and the two that differentiate the tool from npm audit.Verified that
self-scanreads the root lockfile and does not descend intoexamples/, so adding a deliberately vulnerable project does not affect CI. Confirmed by running the self-scan command with the project present.Closes #1103