athenz

Repository on GitHub, which provides public git repositories with URLs. https://github.com/AthenZ

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Reviews are done via GitHub Pull Requests

Repository on GitHub, which uses git. git is distributed.

Project releases happen via Git tags https://github.com/AthenZ/athenz/tags & all the relevant artifacts are available on Maven Central.

https://github.com/AthenZ/athenz/tags

GitHub release tags include human readable release notes - e.g https://github.com/AthenZ/athenz/releases/tag/v1.10.8

Releases have link to individual pull requests which also include CVE fixes etc. e.g https://github.com/AthenZ/athenz/releases/tag/v1.10.8 We don't typically call out each vulnerability which gets fixed by dependency upgrade.

Project uses GitHub issues to track bug reports https://github.com/AthenZ/athenz/issues

https://github.com/AthenZ/athenz/issues

Activity on GitHub issues https://github.com/AthenZ/athenz/issues

All the feature and / or enhancement requests are tracked via github issues https://github.com/AthenZ/athenz/issues

https://github.com/AthenZ/athenz/issues https://github.com/AthenZ/athenz/pulls

https://github.com/AthenZ/athenz/security/policy

https://github.com/AthenZ/athenz/security/policy mentions an email address to submit vulnerability reports.

Maintainers strictly follow the security policy mentioned at https://github.com/AthenZ/athenz/security/policy

Non-trivial build file in repository: https://github.com/AthenZ/athenz/blob/master/pom.xml. Project can be built locally using Java and Maven and it has a CI/CD set up using another open source project - https://screwdriver.cd

Non-trivial build file in repository: https://github.com/AthenZ/athenz/blob/master/pom.xml. Project is built using Java, Maven, Go and Node.

Athenz is built using screwdriver.cd which is a CD Foundation project - https://screwdriver.cd/

Unit tests are executed as part of the build.

Unit tests are executed as part of the build, using standard maven build process.

sub-module POMs enforce minimum required code coverage and PR builds will fail if the new code does not satisfy the conditions.

Athenz main branch build is triggered on every merge and automated tests run in every build.

sub-module POMs enforce minimum required code coverage and PR builds will fail if the new code does not satisfy the conditions.

sub-module POMs enforce minimum required code coverage and PR builds will fail if the new code does not satisfy the conditions.

sub-module POMs enforce minimum required code coverage and PR builds will fail if the new code does not satisfy the conditions.

Athenz uses checkstyle for java, native go linter for go and eslint for javascript modules.

Main maven build is set to fail on warnings.

Main maven build is set to fail on warnings.

Athenz Project maintainers are well versed in Secure Software Development Practices. Primary contributors to the project are from Verizon Media and Yahoo! Japan with their own internal Security teams who evaluate the product periodically for any vulnerabilities since Athenz is used at enterprise scale within these organizations.

Athenz Project maintainers are well versed in Secure Software Development Practices.

The Athenz project uses standard open-source implementations of cryptographic protocols and algorithms. Examples: Bouncy Castle https://www.bouncycastle.org/

Athenz doesn't implement any cryptographic functions, rather it uses open source libraries like Bouncy Castle

Athenz as well as its dependencies are fully FLOSS.

Athenz relies on underlying cryptography libraries like OpenSSL and Bouncy Castle.

Athenz provides a fully configurable way to start its servers with recommended security configurations like included cipher suites, excluded cipher suites, excluded protocols etc. e.g. https://github.com/AthenZ/athenz/blob/master/servers/zts/conf/athenz.properties#L49-L64

Athenz is not dependent on cryptographic algorithms or modes with known serious weaknesses like SHA-1

In all use-cases we use the default forward secrecy provided by 3rd-party open-source libraries for handling https, ssh etc.

Pipeline secrets in CICD use PBKDF2

Athenz servers use Bouncy Castle which is a provider for the Java Cryptography Extension (JCE), Java Cryptography Architecture (JCA) and for the Java Secure Socket Extension (JSSE).

Athenz uses https. Artifacts are signed before uploading to Maven Central.

Athenz does not distribute hashes but rely on Maven Central for software distribution,

We don't have any existing unpatched vulnerabilities which are known publicly.we do actively look into reports and fixes from automated tools like Dependabot from Github and address vulnerabilities.

Athenz maintainers actively looks into any vulnerability reports and strives to fix them in a timely manner

No public repositories under AthenZ GitHub org have any leaked credentials https://github.com/AthenZ

Athenz uses SonarCloud as well as GitHub Dependabot for SAST and SCA

https://sonarcloud.io/dashboard?id=AthenzSonar-com.yahoo.athenz%3Aathenz

Maintainers follow the SonarCloud report and fixing the medium and higher severity exploitable vulnerabilities

It will be integrated with CI build.

We are working on onboarding to a dynamic analysis tool but Athenz is not using one today. Unit tests for individual sub-modules do have a good coverage with negative and boundary condition input testing.

Athenz uses Java, Go and JavaScript which are memory-safe languages.

Athenz servers produce run-time events such as logs and metrics which are exposed to monitoring tools and can be used for dynamic analysis.

Athenz does not use DAST today.