Security on Software Factory

JFrog Xray Vulnerability Scan

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Xray detects known vulnerabilities (CVEs) in the components of your repositories, builds and release bundles.

It identifies each component, maps it to known vulnerabilities from public and proprietary sources and lets you enforce security policies using policies and watches mechanism.

For background on how Xray works, see Xray Page .
For license compliance, see Xray License Scanning .

Prerequisites

Before you start, make sure you have:

Access to a JFrog Platform instance with Xray enabled
A dedicated Project.
A role with Manage Xray Data, Manage Watches & Policies and Manage Reports permission within that project.
JFrog CLI installed and configured

Create a vulnerability policy

A policy defines what counts as a violation and what action Xray takes when one is found.

Secrets, Tokens and Credentials in SonarQube

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by a non-administrator user in SonarQube.

For each item, a concise explanation of its usage and a link to the official documentation are provided.

Type	Description	Details
User Token	Full user-level authentication token, inherits all user permissions	User Token
Project Analysis Token	Scoped token for running analyses on a single project	Project Analysis Token
Global Analysis Token	Token for running analyses on all projects in the instance	Global Analysis Token
Webhook Secret	HMAC-SHA256 secret to verify authenticity of webhook payloads	Webhook Secret
Project Badge Token	Auto-generated token for displaying project metrics badges	Project Badge Token
DevOps Platform PAT	GitLab PAT for project import and Merge Request decoration	DevOps Platform Integration
Login/Password (deprecated)	Legacy authentication method, replaced by tokens	Login/Password

User Token

Description

Authentication token that allows a user to perform all actions the user can do via the web interface, without using their actual credentials (login/password).

Secure your Repository

Mon, 01 Jan 0001 00:00:00 +0000

Securing your repository is essential to maintain the integrity and confidentiality of your code base. This guide covers the practices for implementing robust access controls, enforcing branch protection, securing secrets, and using groups efficiently within GitLab.

Implement Access Controls

Establishing strong access controls is fundamental for repository security.

Properly configured permissions ensure only authorized individuals can perform sensitive actions like pushing code, merging changes, or altering project settings.