I’m trying to feel more comfortable using random GitHub projects, basically.
- MajorHavoc ( @MajorHavoc@programming.dev ) 11•19 days ago
Privado CLI will produce a list of data exfilration points in the code.
If the JSON output file points out a bunch of endpoints you don’t recognize from the README, then I wouldn’t trust the project.
Privado likely won’t catch a malicious binary file, but your local PC antivirus likely will.
- moonpiedumplings ( @moonpiedumplings@programming.dev ) 10•18 days ago
The solution to what you want is not to analyze the code projects automagically, but rather to run them in a container/virtual machine. Running them in an environment which restricts what they can access limits the harm an intentional — or accidental bug can do.
There is no way to automatically analyze code for malice, or bugs with 100% reliability.
Of course, 100% reliability is impossible even with human reviewers. I just want a tool that gives me at least something, cause I don’t have the time or knowledge to review a full repo before executing it on my machine.
- FizzyOrange ( @FizzyOrange@programming.dev ) 3•18 days ago
That is another tool you can use to reduce the risk of malicious code, but it isn’t perfect, so using sandboxing doesn’t mean you can forget about all other security tools.
There is no way to automatically analyze code for malice, or bugs with 100% reliability.
He wasn’t asking for 100% reliability. 100% and 0% are not the only possibilities.
- thingsiplay ( @thingsiplay@beehaw.org ) 6•19 days ago
Not exactly what you asked, but related; roast your Github profile: https://github-roast.pages.dev/
- Kissaki ( @Kissaki@programming.dev ) English3•18 days ago
How is that related? I don’t see it.
- thingsiplay ( @thingsiplay@beehaw.org ) 1•18 days ago
It’s an AI tool analyzing a Git repo.
- Kissaki ( @Kissaki@programming.dev ) English1•15 days ago
It doesn’t analyze only one repo
- adr1an ( @anzo@programming.dev ) 1•18 days ago
Perhaps snyk.io I used it in the past, but I didn’t find it quite useful. Now I have a github action to upgrade dependencies every week. But you want some kind of scanner to be more involved on the actual codebase. Did you look into https://github.com/marketplace?query=security ? That’s what I would do. But I never heard of any of those listed there. Let us know your findings after some time if you test 'em ;) good luck!