Clone this repo:

Branches

  1. 521f685 fix(deps): update module google.golang.org/api to v0.176.1 by Renovate bot · 8 weeks ago main
  2. ca34cad chore(deps): don't update go.skia.org/infra by Adrià Vilanova · 8 weeks ago
  3. b5bf5e8 chore(deps): pin dependencies by Renovate bot · 6 months ago v0.1.1
  4. 33f629f chore: deploy Docker image to internal registry by Adrià Vilanova Martínez · 6 months ago v0.1.0
  5. 42650a7 chore: Configure Renovate by Renovate bot · 6 months ago

Vulnzy Bot

A bot which is responsible for managing the vulnerability reports published at https://iavm.xyz/b/vulnz.

Tasks

The bot performs the following tasks:

Automatically publish vulnerability reports after the deadline

The bot will search private (restricted) vulnerability reports and will do the following:

  • If the report has the "DoNotPublish" label, don't automatically publish it.
  • If the report was marked with status "Fixed" or "Verified" more than 30 days ago, publish it.
  • If the report isn't marked as "Fixed"/"Verified" and the "Reported" value is previous to the current time subtracting the number of days set in the "Deadline" field, publish it.

In all the calculations above, a grace period of 1 day is added (so in reality it's 31 days instead of 30, and Deadline + 1 day instead of Deadline).

Add a disclosure alert 5 days before it is automatically disclosed

The bot will add a comment to a vulnerability report 5 days before it is automatically disclosed as explained in the previous section.

Set up

  1. Set up Git Watcher:
    • Create a service account in your Google Cloud project.
    • Give it permission to use the Monorail API.
    • Give it appropiate permissions in each Monorail project.
    • Create subdirectory //secret/ and download the service accounts credentials JSON file to //secret/credentials.json.
    • Copy the .env.sample file to .env and edit it to your liking.
    • Run make docker-prod and docker-compose up -d.