[SEC-WG] Audit for Webpack?

To separate topics from #9, I’m opening this.

It might be interesting to have an audit to find vulnerabilities. For example, Express did this a long time ago (https://expressjs.com/2024/10/22/security-audit-milestone-achievement.html
). In Express’s case, it was done through https://ostif.org/
and funded by Sovereign Tech Agency. We could try to achieve the same.

Now that we have a triage team, this seems like a good idea

@UlisesGascon

For posterity, @UlisesGascon submitted the form to see if we are accepted by the STA to be audited.

No news so far, I will try to contact the team directly 👍

@UlisesGascon

status awaiting @UlisesGascon input

@UlisesGascon

status: @UlisesGascon & @bjohansebas will work on auditing.

I think that we can run https://github.com/alpha-omega-security/scrutineer/ against our repos and collect potential vulnerabilities and triage them.

@UlisesGascon

@UlisesGascon how are results outputted using this?

At the moment I have access to Codex, and possibly Codex for security as well (I’m not sure if that was enabled for me) but we could use that too.

Navigation Menu