Repository navigation
docs(security): OWASP Top 10:2025 assessment; private vulnerability reporting - #47
Merged
Merged
Conversation
- Rate OSIRIS against each OWASP Top 10:2025 category (residual risk after mitigations, with evidence and recommendations): 0 High, 4 Medium (A01, A02, A06, A09), 6 Low. Based on code review, CodeQL triage, an OWASP ZAP baseline scan, OpenSSF Scorecard, npm audit / audit signatures, ClamAV and secret scanning. - List the automated controls and where they run. - Reporting: the old text asked for no public disclosure but told reporters to open an issue. Point to GitHub private vulnerability reporting instead, with response timelines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a rated OWASP Top 10:2025 assessment to
SECURITY.mdand fixes the vulnerability-reporting section.Ratings (residual risk after current mitigations)
0 High · 4 Medium · 6 Low. Each category lists evidence (what's in place, with PR references) and what's still open.
Evidence gathered for this assessment
X-Powered-By), 5 Informational; 60 rules passed.main.npm audit(0 prod),npm audit signatures(842/842 verified), ClamAV (0 infected), secret scanning (0).Notable open findings (documented, not fixed here)
src/middleware.tssends every page view with the visitor's IP to a hardcodedhttp://umami-umami-1:3000analytics host, with a default site ID inherited from upstream./api/scannerlets any visitor trigger scans whenSCANNER_KEYis set (mitigated by the SSRF guard, scan-type allowlist and rate limiting); rate limiting trusts forgeableX-Forwarded-For.ip-api.com.Reporting a vulnerability
The old text said "don't disclose publicly" but told reporters to open an issue. It now points to GitHub private vulnerability reporting with response timelines.
⚠️ Private reporting is currently disabled on the repo, so the link needs it switched on (repo setting).
🤖 Generated with Claude Code