|
1 | 1 | # 🔒 Security Policy
|
2 | 2 |
|
3 |
| -Intel is committed to rapidly addressing security vulnerabilities affecting our customers and providing clear guidance on the solution, impact, severity and mitigation. |
| 3 | +Intel is committed to rapidly addressing security vulnerabilities affecting our |
| 4 | +customers and providing clear guidance on the solution, impact, severity, and |
| 5 | +mitigation. |
| 6 | + |
| 7 | +## Security Tools and Practices |
| 8 | + |
| 9 | +### Integrated Security Scanning with Bandit and Trivy |
| 10 | + |
| 11 | +To ensure our codebase remains secure, we leverage GitHub Actions for continuous |
| 12 | +security scanning with the following tools: |
| 13 | + |
| 14 | +- **Bandit:** Automatically scans our Python code for common security issues, |
| 15 | + helping us identify and mitigate potential vulnerabilities proactively. |
| 16 | +- **Trivy:** Integrated into our CI/CD pipeline via GitHub Actions, Trivy scans |
| 17 | + our project's dependencies and container images for known vulnerabilities, |
| 18 | + ensuring our external components are secure. |
| 19 | + |
| 20 | +These integrations ensure that every commit and pull request is automatically |
| 21 | +checked for security issues, allowing us to maintain a high security standard |
| 22 | +across our development lifecycle. |
| 23 | + |
| 24 | +### External Security Scanning with Checkmarx |
| 25 | + |
| 26 | +In addition to our integrated tools, we utilize Checkmarx for static application |
| 27 | +security testing (SAST). This comprehensive analysis tool is run externally to |
| 28 | +scrutinize our source code for security vulnerabilities, complementing our |
| 29 | +internal security measures with its advanced detection capabilities. |
4 | 30 |
|
5 | 31 | ## 🚨 Reporting a Vulnerability
|
6 | 32 |
|
|
18 | 44 |
|
19 | 45 | We encourage users to report security issues and contribute to the security of
|
20 | 46 | our project 🛡️. Contributions can be made in the form of code reviews, pull
|
21 |
| -requests, and constructive feedback. |
22 |
| -Refer to our [CONTRIBUTING.md](CONTRIBUTING.md) for more details. |
| 47 | +requests, and constructive feedback. Refer to our |
| 48 | +[CONTRIBUTING.md](CONTRIBUTING.md) for more details. |
23 | 49 |
|
24 | 50 | ---
|
25 | 51 |
|
26 |
| -> **NOTE:** This security policy is subject to change 🔁. Users are encouraged to check this |
27 |
| -> document periodically for updates. |
| 52 | +> **NOTE:** This security policy is subject to change 🔁. Users are encouraged |
| 53 | +> to check this document periodically for updates. |
0 commit comments