{"action":"created","issue":{"url":"https://api.github.com/repos/18F/cg-product/issues/260","repository_url":"https://api.github.com/repos/18F/cg-product","labels_url":"https://api.github.com/repos/18F/cg-product/issues/260/labels{/name}","comments_url":"https://api.github.com/repos/18F/cg-product/issues/260/comments","events_url":"https://api.github.com/repos/18F/cg-product/issues/260/events","html_url":"https://github.com/18F/cg-product/issues/260","id":174387850,"number":260,"title":"Upstream code is scanned for vulnerabilities before being allowed into production","user":{"login":"mogul","id":47762,"avatar_url":"https://avatars.githubusercontent.com/u/47762?v=3","gravatar_id":"","url":"https://api.github.com/users/mogul","html_url":"https://github.com/mogul","followers_url":"https://api.github.com/users/mogul/followers","following_url":"https://api.github.com/users/mogul/following{/other_user}","gists_url":"https://api.github.com/users/mogul/gists{/gist_id}","starred_url":"https://api.github.com/users/mogul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mogul/subscriptions","organizations_url":"https://api.github.com/users/mogul/orgs","repos_url":"https://api.github.com/users/mogul/repos","events_url":"https://api.github.com/users/mogul/events{/privacy}","received_events_url":"https://api.github.com/users/mogul/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/18F/cg-product/labels/Atlas","name":"Atlas","color":"0052cc"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/18F/cg-product/milestones/5","html_url":"https://github.com/18F/cg-product/milestones/FedRAMP%20JAB%20review%20remediations","labels_url":"https://api.github.com/repos/18F/cg-product/milestones/5/labels","id":1989888,"number":5,"title":"FedRAMP JAB review remediations","description":"This is the set of issues to be addressed before the JAB Technical Reviewers are content for cloud.gov to enter the Review phase. \r\n\r\nFeatures included:\r\nInstall [ZenHub](https://www.zenhub.com/) and look at [the burndown view](https://github.com/18F/cg-product/milestone/5#burndown?milestoneId=5) to get a sense of how stories are progressing. We also provide a [view of this work as it progresses across our kanban board](https://github.com/18F/cg-product#boards?notFullScreen=false&epic=55727091,243&showPRs=false).","creator":{"login":"mogul","id":47762,"avatar_url":"https://avatars.githubusercontent.com/u/47762?v=3","gravatar_id":"","url":"https://api.github.com/users/mogul","html_url":"https://github.com/mogul","followers_url":"https://api.github.com/users/mogul/followers","following_url":"https://api.github.com/users/mogul/following{/other_user}","gists_url":"https://api.github.com/users/mogul/gists{/gist_id}","starred_url":"https://api.github.com/users/mogul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mogul/subscriptions","organizations_url":"https://api.github.com/users/mogul/orgs","repos_url":"https://api.github.com/users/mogul/repos","events_url":"https://api.github.com/users/mogul/events{/privacy}","received_events_url":"https://api.github.com/users/mogul/received_events","type":"User","site_admin":false},"open_issues":16,"closed_issues":0,"state":"open","created_at":"2016-09-07T21:42:40Z","updated_at":"2016-09-07T21:55:29Z","due_on":"2016-09-30T00:00:00Z","closed_at":null},"comments":2,"created_at":"2016-08-31T21:50:21Z","updated_at":"2016-09-08T03:17:42Z","closed_at":null,"body":"In order to mitigate the risk of a subtle code vulnerability being introduced into production cloud.gov by a careless/malicious open source contributor, all code from upstream sources goes through a scan for vulnerabilities before we allow it into production.\r\n\r\n**Acceptance Criteria**\r\n\r\n- [ ] We demonstrate that upstream code is tested for vulnerabilities before we put it into production\r\n- [ ] A sentinel vulnerability demonstrably causes our tests to fail\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/18F/cg-product/issues/comments/245482594","html_url":"https://github.com/18F/cg-product/issues/260#issuecomment-245482594","issue_url":"https://api.github.com/repos/18F/cg-product/issues/260","id":245482594,"user":{"login":"afeld","id":86842,"avatar_url":"https://avatars.githubusercontent.com/u/86842?v=3","gravatar_id":"","url":"https://api.github.com/users/afeld","html_url":"https://github.com/afeld","followers_url":"https://api.github.com/users/afeld/followers","following_url":"https://api.github.com/users/afeld/following{/other_user}","gists_url":"https://api.github.com/users/afeld/gists{/gist_id}","starred_url":"https://api.github.com/users/afeld/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/afeld/subscriptions","organizations_url":"https://api.github.com/users/afeld/orgs","repos_url":"https://api.github.com/users/afeld/repos","events_url":"https://api.github.com/users/afeld/events{/privacy}","received_events_url":"https://api.github.com/users/afeld/received_events","type":"User","site_admin":false},"created_at":"2016-09-08T03:17:42Z","updated_at":"2016-09-08T03:17:42Z","body":"We did some evaluation of various proprietary scanning tools as part of the [Compliance Toolkit](https://github.com/18F/compliance-toolkit) project, but at least for web projects, didn't find anything that did any better than [the open source options](https://pages.18f.gov/before-you-ship/security/static-analysis/#code-analysis). We could scan things like the Cloud Controller for web vulnerabilities, but there isn't any such thing as a generic scanner for any type of code, that I'm aware of.\r\n\r\n/cc @jacobian "}}
{"actor":{"display_login":"afeld"}}