Skip to content

Commit f8e61d0

Browse files
timothywarnertimothywarner
authored
Merge pull request #2 from timothywarner-org/claude/add-security-metadata-01CZwhjpgHGQcqRwrJxVdczK
Add security docs and repository metadata
2 parents b955a0a + a96b4b4 commit f8e61d0

8 files changed

Lines changed: 917 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 292 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,292 @@
1+
# Dependabot Configuration
2+
# =========================
3+
# Comprehensive dependency management for security and version updates
4+
# Documentation: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
5+
6+
version: 2
7+
8+
registries:
9+
# Add private registries here if needed
10+
# npm-npmjs:
11+
# type: npm-registry
12+
# url: https://registry.npmjs.org
13+
# token: ${{ secrets.NPM_TOKEN }}
14+
15+
updates:
16+
# ==========================================================================
17+
# GitHub Actions - Keep CI/CD workflows secure and up-to-date
18+
# ==========================================================================
19+
- package-ecosystem: "github-actions"
20+
directory: "/"
21+
schedule:
22+
interval: "weekly"
23+
day: "monday"
24+
time: "06:00"
25+
timezone: "America/New_York"
26+
open-pull-requests-limit: 10
27+
labels:
28+
- "dependencies"
29+
- "github-actions"
30+
- "security/vulnerability"
31+
commit-message:
32+
prefix: "ci"
33+
include: "scope"
34+
reviewers:
35+
- "timothywarner-org"
36+
groups:
37+
# Group all GitHub Actions updates together
38+
github-actions:
39+
patterns:
40+
- "*"
41+
update-types:
42+
- "minor"
43+
- "patch"
44+
45+
# ==========================================================================
46+
# Root NPM Dependencies - Main project JavaScript/Node.js packages
47+
# ==========================================================================
48+
- package-ecosystem: "npm"
49+
directory: "/"
50+
schedule:
51+
interval: "daily"
52+
time: "06:00"
53+
timezone: "America/New_York"
54+
open-pull-requests-limit: 15
55+
labels:
56+
- "dependencies"
57+
- "javascript"
58+
- "security/vulnerability"
59+
commit-message:
60+
prefix: "deps"
61+
include: "scope"
62+
reviewers:
63+
- "timothywarner-org"
64+
# Ignore intentionally vulnerable packages in demo apps
65+
ignore:
66+
- dependency-name: "*"
67+
update-types: ["version-update:semver-major"]
68+
groups:
69+
# Security-related packages - high priority
70+
security-packages:
71+
patterns:
72+
- "helmet*"
73+
- "express-rate-limit*"
74+
- "bcrypt*"
75+
- "jsonwebtoken*"
76+
- "passport*"
77+
- "cors"
78+
- "csurf"
79+
- "xss*"
80+
- "sanitize*"
81+
- "validator*"
82+
update-types:
83+
- "minor"
84+
- "patch"
85+
# Testing frameworks
86+
testing:
87+
patterns:
88+
- "jest*"
89+
- "mocha*"
90+
- "chai*"
91+
- "supertest*"
92+
- "cypress*"
93+
- "@testing-library/*"
94+
update-types:
95+
- "minor"
96+
- "patch"
97+
# Linting and code quality
98+
linting:
99+
patterns:
100+
- "eslint*"
101+
- "prettier*"
102+
- "@typescript-eslint/*"
103+
- "eslint-plugin-*"
104+
update-types:
105+
- "minor"
106+
- "patch"
107+
# Development dependencies
108+
dev-dependencies:
109+
patterns:
110+
- "nodemon*"
111+
- "typescript*"
112+
- "ts-node*"
113+
- "@types/*"
114+
update-types:
115+
- "minor"
116+
- "patch"
117+
118+
# ==========================================================================
119+
# NodeGoat - Intentionally Vulnerable Node.js Application
120+
# ==========================================================================
121+
- package-ecosystem: "npm"
122+
directory: "/NodeGoat"
123+
schedule:
124+
interval: "weekly"
125+
day: "wednesday"
126+
time: "06:00"
127+
timezone: "America/New_York"
128+
open-pull-requests-limit: 5
129+
labels:
130+
- "dependencies"
131+
- "javascript"
132+
- "nodegoat"
133+
- "lesson-01"
134+
commit-message:
135+
prefix: "deps(nodegoat)"
136+
include: "scope"
137+
# Only update non-vulnerable demo dependencies
138+
# Some vulnerabilities are intentional for training
139+
allow:
140+
- dependency-type: "development"
141+
- dependency-type: "production"
142+
ignore:
143+
# Intentionally keeping some packages at vulnerable versions for demos
144+
- dependency-name: "marked"
145+
versions: ["< 4.0.0"]
146+
- dependency-name: "mongoose"
147+
versions: ["< 6.0.0"]
148+
149+
# ==========================================================================
150+
# WebGoat - Intentionally Vulnerable Java Application
151+
# ==========================================================================
152+
- package-ecosystem: "maven"
153+
directory: "/WebGoat"
154+
schedule:
155+
interval: "weekly"
156+
day: "wednesday"
157+
time: "06:00"
158+
timezone: "America/New_York"
159+
open-pull-requests-limit: 5
160+
labels:
161+
- "dependencies"
162+
- "java"
163+
- "webgoat"
164+
- "maven"
165+
commit-message:
166+
prefix: "deps(webgoat)"
167+
include: "scope"
168+
reviewers:
169+
- "timothywarner-org"
170+
171+
# ==========================================================================
172+
# Lesson 01 - Vulnerability Detection Demos
173+
# ==========================================================================
174+
- package-ecosystem: "npm"
175+
directory: "/lesson-01/demo-03-xss/secure-react-app"
176+
schedule:
177+
interval: "weekly"
178+
day: "thursday"
179+
time: "06:00"
180+
timezone: "America/New_York"
181+
open-pull-requests-limit: 3
182+
labels:
183+
- "dependencies"
184+
- "javascript"
185+
- "lesson-01"
186+
- "security/xss"
187+
commit-message:
188+
prefix: "deps(lesson-01)"
189+
190+
- package-ecosystem: "npm"
191+
directory: "/lesson-01/demo-04-custom-scanners/scanner"
192+
schedule:
193+
interval: "weekly"
194+
day: "thursday"
195+
time: "06:00"
196+
timezone: "America/New_York"
197+
open-pull-requests-limit: 3
198+
labels:
199+
- "dependencies"
200+
- "javascript"
201+
- "lesson-01"
202+
- "tool/sast"
203+
commit-message:
204+
prefix: "deps(lesson-01)"
205+
206+
- package-ecosystem: "npm"
207+
directory: "/lesson-01/demo-04-custom-scanners/idor-app"
208+
schedule:
209+
interval: "weekly"
210+
day: "thursday"
211+
time: "06:00"
212+
timezone: "America/New_York"
213+
open-pull-requests-limit: 3
214+
labels:
215+
- "dependencies"
216+
- "javascript"
217+
- "lesson-01"
218+
commit-message:
219+
prefix: "deps(lesson-01)"
220+
221+
# ==========================================================================
222+
# Docker - Container image updates
223+
# ==========================================================================
224+
- package-ecosystem: "docker"
225+
directory: "/NodeGoat"
226+
schedule:
227+
interval: "weekly"
228+
day: "friday"
229+
time: "06:00"
230+
timezone: "America/New_York"
231+
open-pull-requests-limit: 3
232+
labels:
233+
- "dependencies"
234+
- "docker"
235+
- "security/vulnerability"
236+
commit-message:
237+
prefix: "docker"
238+
include: "scope"
239+
240+
- package-ecosystem: "docker"
241+
directory: "/WebGoat"
242+
schedule:
243+
interval: "weekly"
244+
day: "friday"
245+
time: "06:00"
246+
timezone: "America/New_York"
247+
open-pull-requests-limit: 3
248+
labels:
249+
- "dependencies"
250+
- "docker"
251+
- "security/vulnerability"
252+
commit-message:
253+
prefix: "docker"
254+
include: "scope"
255+
256+
# ==========================================================================
257+
# Terraform - Infrastructure as Code updates
258+
# ==========================================================================
259+
- package-ecosystem: "terraform"
260+
directory: "/lesson-02/demo-04-zero-trust/terraform"
261+
schedule:
262+
interval: "weekly"
263+
day: "friday"
264+
time: "06:00"
265+
timezone: "America/New_York"
266+
open-pull-requests-limit: 3
267+
labels:
268+
- "dependencies"
269+
- "terraform"
270+
- "tool/terraform"
271+
- "lesson-02"
272+
commit-message:
273+
prefix: "terraform"
274+
include: "scope"
275+
276+
- package-ecosystem: "terraform"
277+
directory: "/lesson-05/demo-01-iac-templates/hardened"
278+
schedule:
279+
interval: "weekly"
280+
day: "friday"
281+
time: "06:00"
282+
timezone: "America/New_York"
283+
open-pull-requests-limit: 3
284+
labels:
285+
- "dependencies"
286+
- "terraform"
287+
- "tool/terraform"
288+
- "lesson-05"
289+
- "security/compliance"
290+
commit-message:
291+
prefix: "terraform"
292+
include: "scope"

‎.github/labels.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,45 @@
144144
color: "f9a7a7"
145145
description: "Advanced level content"
146146

147+
# =============================================================================
148+
# DEPENDABOT & DEPENDENCY LABELS
149+
# =============================================================================
150+
- name: "dependencies"
151+
color: "0366d6"
152+
description: "Dependency updates (Dependabot)"
153+
154+
- name: "security-update"
155+
color: "ee0701"
156+
description: "Security-related dependency update"
157+
158+
- name: "javascript"
159+
color: "f1e05a"
160+
description: "JavaScript/Node.js related"
161+
162+
- name: "java"
163+
color: "b07219"
164+
description: "Java related"
165+
166+
- name: "docker"
167+
color: "2496ed"
168+
description: "Docker/container related"
169+
170+
- name: "maven"
171+
color: "c71a36"
172+
description: "Maven dependency management"
173+
174+
- name: "nodegoat"
175+
color: "68a063"
176+
description: "NodeGoat vulnerable application"
177+
178+
- name: "webgoat"
179+
color: "orange"
180+
description: "WebGoat vulnerable application"
181+
182+
- name: "github-actions"
183+
color: "2088ff"
184+
description: "GitHub Actions CI/CD updates"
185+
147186
# =============================================================================
148187
# GENERAL PURPOSE LABELS
149188
# =============================================================================
@@ -170,3 +209,15 @@
170209
- name: "documentation"
171210
color: "0075ca"
172211
description: "Documentation improvements"
212+
213+
- name: "wontfix"
214+
color: "ffffff"
215+
description: "This will not be worked on"
216+
217+
- name: "duplicate"
218+
color: "cfd3d7"
219+
description: "This issue or PR already exists"
220+
221+
- name: "invalid"
222+
color: "e4e669"
223+
description: "This doesn't seem right"

‎.github/topics.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"_description": "Repository topics for GitHub UI visibility. Apply via repository settings or GitHub API.",
3+
"_instructions": "Navigate to Settings > General > Topics or use: gh repo edit --add-topic <topic>",
4+
"topics": [
5+
"github-copilot",
6+
"cybersecurity",
7+
"security",
8+
"devsecops",
9+
"vulnerability-detection",
10+
"secure-coding",
11+
"owasp",
12+
"appsec",
13+
"penetration-testing",
14+
"sast",
15+
"dast",
16+
"compliance",
17+
"nist",
18+
"cis-benchmarks",
19+
"zero-trust",
20+
"threat-modeling",
21+
"security-automation",
22+
"incident-response",
23+
"infrastructure-as-code",
24+
"video-course"
25+
],
26+
"apply_script": "for topic in $(jq -r '.topics[]' .github/topics.json); do gh repo edit --add-topic \"$topic\"; done"
27+
}

0 commit comments

Comments
 (0)