3

Dependabot and npm audit both poll the Node Security Working Group database for Node-based projects. However, Dependabot has the added ability to check dependencies in numerous other types of projects as well. Also, each report Dependabot generates includes useful info and links directly to a GitHub Advisory Database listing (e.g., CVE-2017-16021) that ...


3

When your configuration or a provider marks an attribute as sensitive, Terraform will always hide that value in any output that's intended for human consumption. The real values are available in machine-readable output though. This is primarily with the aim of integrating with external software, but if you need to then you can also inspect the machine-...


2

If it is FTP (and not FTPS) then yes, it is a high severity risk. You are sending unencrypted traffic over the open internet. Even if you are whitelisting specific IP addresses, the traffic is still unencrypted between those specific instances. In addition, FTP is a very old (created in 1971) and non-secure protocol. It is not meant to be a secure method of ...


1

The pricing of these images says its $130/year (for software + AWS usage): Does this mean running costs of EC2 are also covered in this pricing? No. If you read the details in the AMI Subscription page, it says in the last sentence: "Charges for using Amazon EC2 and other services from AWS are separate and in addition to what you pay to purchase AWS ...


1

Not technically, I understand your need to create and destroy EC2 instances, whether it's done via automation or not. About having permissions at the security group level, this can often be limited to viewing only the resource, as it is a networking firewall resource, usually who manages these objects are SDN or NaaS


1

This sounds like you are applying Ansible playbooks locally on peoples workstations. The best way to protect this would be applying the playbooks using a remote system, like AWX or a CI system such as GitHub Actions or TeamCity. The CI system would have the ability to decrypt the vault and run the playbooks. Mostly the CI system can expose the vault password ...


1

I have come to the (preliminary) conclusion that this cannot be done. First, I had set the wrong idp-issuer-url. I had selected the IDP that normally serves during OIDC authentication to the Kubernetes cluster. But $token (or $CI_JOB_JWT in GitLab CI/CD parlance) was not generated there but by GitLab instead. Inspection e.g. at jwt.io indicates "iss&...


1

As you stated, requirements will differ based on company and industry policy; for us, the adjustment from "separation of duties" to automated deployments has been rough. As interim steps, we've started: Requiring multiple "sign-offs" before deployment; this is accomplished by both reviews for the PR in Azure DevOps and an audit log in ...


1

When you use network_mode host, the published ports are ignored, which means the ports that are open in the containers will be the same port in the host. Does not matter what you had declared in ports The default behavior is every service in the compose can talk to each other. Links are not required to enable services to communicate - by default, any ...


1

As per October 2021: GitHub Advisory Database now powers npm audit : "This means that every version of the npm CLI that supports security audits is now talking directly to the GitHub Advisory Database" - The GitHub Advisory Database is what powers Dependabot and now also npm audit https://github.blog/2021-10-07-github-advisory-database-now-powers-...


Only top voted, non community-wiki answers of a minimum length are eligible