[FINERACT-988] Snyk.io Security Vulnerability Assessment Scanning

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Auto Closed
• Component/s: Security
• Labels: Cleanup2022 technical
• Assignee: Unassigned
• Reporter: Michael Vorburger
• Created: 21/May/20 12:15
• Updated: 07/Nov/22 18:11
• Resolved: 07/Nov/22 18:11

Description

Explore using https://snyk.io for Fineract, but INFRA-16598 is noteworthy.

FINERACT-967 is very related, perhaps continue there, first, before this?

FINERACT-854 and FINERACT-853 should be our first and foremost priority, IMHO.

Issue Links

• blocks: FINERACT-865 Strengthen/Harden Fineract 1.x to LTS Version by Upgrading Java & Improving Code Coverage of Tests
• is blocked by: FINERACT-853 Use find-sec-bugs SpotBugs plugin to detect SQL injection issues (and other security related problems)
• is blocked by: FINERACT-854 Use prepared statements instead of string concatenated SQL everywhere
• is related to: FINERACT-969 Run OWASP zaproxy.org against Fineract (e.g. fineract.dev)
• is related to: FINERACT-967 lgtm.com Security Vulnerability Assessment Scanning