You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Apr 21, 2026. It is now read-only.
Done! :) Now you can start developing and contributing.
16
15
17
-
For development:
16
+
Done! :) Now you can start developing and contributing.
17
+
18
+
For development:
19
+
18
20
```bash
19
21
npm run develop
20
22
```
23
+
21
24
For production locally:
25
+
22
26
```bash
23
27
npm run build
24
28
npm run serve
25
29
```
30
+
26
31
And then visit [this](http://localhost:8000/) in your browser.
27
32
28
33
## Style Guide
@@ -36,12 +41,12 @@ The color scheme is aimed to be basically white with a soft blue coloring as the
36
41
Included colors:
37
42
38
43
```
39
-
$white: #ffffff;
44
+
$white: #ffffff;
40
45
$black: #000000;
41
46
$primary: #1c3ed3; // Strong blue tone
42
47
$iteragenta: #a9218e; // iteratec's main color (avoid using it ;) )
43
48
$highlight: #7c00ce57; // Gentle, half transparent violet-ish for highlighting
44
-
$secureCodeBlue: #3296dc; // Main, soft blue tone
49
+
$secureCodeBlue: #3296dc; // Main, soft blue tone
45
50
$secondary: #414156; // Grey, used for non-header text
46
51
```
47
52
@@ -59,21 +64,191 @@ Used Fonts:
59
64
'Segoe UI Symbol';
60
65
```
61
66
62
-
### Icons & Images
67
+
### Icons & Images
68
+
69
+
Icons should be license free and as close to the other icons' style as possible. They should be outlined and monochrome. Color should only be used to fill, never as line color, and only if color does provide a more pleasing look than monochrome. Images should be fitting and mainly used as background (partially). They should fit the color scheme if possible or do **not** stand out through a high contrast to the website. Recommended websites for free icons or images:
70
+
71
+
-[iconmonstr](https://iconmonstr.com/)
72
+
-[pixabay](https://pixabay.com/)
73
+
74
+
## Documentation Guide
75
+
76
+
Since we work with various different tools, it is even more important to keep a clean and well structured Documentation. Our website's purpose is to provide a comfortable navigation and clear overview. But since no one is going to update the documentation if it's untraceable, it is also very important to keep the documentation's location clear and as less spread as possible throughout our project. So no single-page documentation hidden in the deep structure of a remote repository! In general it is much easier and simpler to keep most of the documentation in this repository, but the scanner documentation due to our project structure. One key feature our documentations share in order to be put on the website is a frontmatter in each documentation. It is mandatory since at least a title and path are required. But it also can provide helpful other information very easily, for a documentation see frontmatter. Don't be afraid to use it for including important information, which you can't get/provide otherwise very well, but don't overuse it! For more detailed examples see the following sections.
77
+
78
+
### Adding a scanner or persistence provider
79
+
80
+
Scanner and persistence provider are referred as integrations. Scanner, which are integrated into our secureCodeBox project have their own repository in which the main documentation must be written in the README.md. Persistence provider documentation is located at `/src/pages/integrations/persistence-provider/`.
81
+
82
+
#### Scanner
83
+
84
+
To add a scanner documentation you need to extend the `scannerRepos` Array in the `gatsby-config.js` file with:
Additionally you can and (for the sake of aesthetics) should provide an icon in `.svg` format (the fancy icons you see on the "Integrations" page), located at `/src/static/integrationIcons`. Simply name it according to the title in the frontmatter, e.g. if the scanner's title is "Arachni" your filename is "Arachni.svg", it's as simple as that. Each of our scanner has a release svg, which needs to be put in the frontmatter of the respective documentation. Our scanner are structured uniformly with a frontmatter of mandatory fields as follows ("Scame" represents the scanner name):
 //not required but nice to have
110
+
111
+
A brief description about this scanner.
112
+
113
+
<!-- end -->
114
+
115
+
# About
116
+
117
+
This repository contains a self contained µService utilizing the Scame scanner for the secureCodeBox project. To learn more about the Scame scanner itself visit [reference the scanner].
118
+
119
+
## Scame parameters
120
+
121
+
To hand over supported parameters through api usage, you can set following attributes:
122
+
123
+
```
124
+
[
125
+
{
126
+
specify parameter and how to configure the scanner
127
+
}
128
+
]
129
+
```
130
+
131
+
## Example
132
+
Provide a simple scan example which everyone can simply reconstruct. Give a Example input/configuration and the according output.
133
+
134
+
## Development
135
+
136
+
### Configuration Options
137
+
138
+
To configure this service specify the following environment variables:
139
+
140
+
| Environment Variable | Value Example |
141
+
| -------------------------- | ------------- |
142
+
| ENGINE_ADDRESS | http://engine |
143
+
| ENGINE_BASIC_AUTH_USER | username |
144
+
| ENGINE_BASIC_AUTH_PASSWORD | 123456 |
145
+
146
+
### Local setup
147
+
148
+
How to set up the scanner locally.
149
+
150
+
### Test
151
+
152
+
How to run the test.
153
+
154
+
### Build with docker
155
+
156
+
How to build the docker container.
157
+
158
+
159
+
>Travis build status
160
+
>License
161
+
>GitHub latest release of our Scame repository
162
+
163
+
[reference the scanner]: url
164
+
165
+
</pre>
166
+
</details>
167
+
168
+
You can add and extend categories as you will, but keep the main structure and if one section would be empty, write an explanation why, if it's not obvious. See this as a adjustable template and have a look at what is written in the other scanner's docs.
169
+
170
+
#### Persistence provider
171
+
172
+
To add a persistence provider documentation simply add the markdown file to the folder mentioned above. To provide an icon do as explained before for the scanner. Our persistence provider are structured uniformly with a frontmatter of mandatory fields as follows ("Perprame" represents the persistence provider name):
A brief description of this persistence provider with reference: [Perprame].
190
+
191
+
## Configuration
192
+
193
+
### Setting the Persistence Provider
194
+
195
+
The engine supports multiple different persistence providers. Each of the prepackaged persistence providers can be toggled on by using environment variables.
196
+
197
+
The currently available persistence providers are:
To activate the persistence providers the `enabled` variable must be set to `"true"`.
208
+
209
+
> **Note**: Most PersistenceProviders require additional configuration to set the location and access credentials. These are documented in the sections for the individual persistence providers below.
210
+
211
+
The corresponding PersistenceProvider-implementation class must have a matching `@ConditionalOnProperty` annotation, e.g. `@ConditionalOnProperty(name = "securecodebox.persistence.perprame.enabled", havingValue = "true")` for Perprame.
212
+
213
+
## Specific Settings
214
+
215
+
#### Enabling Perprame as Persistence Provider
216
+
217
+
To use Perprame for persistence set `securecodebox.persistence.perprame.enabled` or the corresponding environment variable to `"true"`.
218
+
219
+
#### Properties / Environment Variables
220
+
221
+
| Property | Example Value | Mandatory |
222
+
| -------- | ------------- | --------- |
223
+
| | | |
224
+
225
+
226
+
[Perprame]: reference url
227
+
228
+
</pre>
229
+
</details>
230
+
231
+
### Adding tutorials or developer docs
232
+
233
+
Currently under development, please provide an explanation to why these are split and how this differentiation is meant.
234
+
235
+
#### Tutorials
236
+
237
+
Currently under development, this will be the guide for our "Get Started" tutorials similar to the ones above.
63
238
64
-
Icons should be license free and as close to the other icons' style as possible. They should be outlined and monochrome. Color should only be used to fill, never as line color, and only if color does provide a more pleasing look than monochrome. Images should be fitting and mainly used as background (partially). They should fit the color scheme if possible or do __not__ stand out through a high contrast to the website. Recommended websites for free icons or images:
239
+
#### Developer docs
65
240
66
-
-[iconmonstr](https://iconmonstr.com/)
67
-
-[pixabay](https://pixabay.com/)
241
+
Currently under development, this will be the guide for our "Docs" developer documentation similar to the ones above.
68
242
69
243
## Production Deployment
70
244
71
-
All changes pushed to the `gh-source` branch get automatically build by GitHub Actions.
245
+
All changes pushed to the `gh-source` branch get automatically build by GitHub Actions.
72
246
The artifacts of the build, aka. the build site, gets forced pushed to the master branch.
73
247
The master branch then gets automatically deployed as a GitHub Page.
DefectDojo is a OpenSource Tools for importing and managing findings of security scanners. The DefectDojo Persistence Provider can be used to create new Engagment for SecurityTest run via the secureCodeBox and import all findings which were identified.
10
+
DefectDojo is an OpenSource Tools for importing and managing findings of security scanner. The DefectDojo persistence provider can be used to create new Engagements for SecurityTests run via the secureCodeBox and import all findings which were identified.
11
11
12
-
Tools which are supported by the secureCodeBox and DefectDojo (OWASP ZAP, Arachni & Nmap) this is done by importing the raw scan report into DefectDojo. Findings by other secureCodeBox supported scanners are currently not directly supported by DefectDojo. These findings are improted via a generic finding api of defectdojo, which might cause some loss of imformation about the findings.
12
+
Tools which are supported by the secureCodeBox and DefectDojo (OWASP ZAP, Arachni & Nmap) this is done by importing the raw scan report into DefectDojo. Findings by other secureCodeBox supported scanners are currently not directly supported by DefectDojo. These findings are imported via a generic finding api of defectDojo, which might cause some loss of information about the findings.
13
13
14
14
To learn more about DefectDojo visit [defectdojo.io].
15
15
16
16
## Configuration
17
17
18
18
### Setting the Persistence Provider
19
19
20
-
The engine supports multiple different persistence providers. Each of the prepackaged persistence providers can be toggle on by using environment variables.
20
+
The engine supports multiple different persistence providers. Each of the prepackaged persistence providers can be toggled on by using environment variables.
21
21
22
-
The currently availible persistence providers are:
22
+
The currently available persistence providers are:
The ElasticSearch PersistenceProvider saves all findings and reports into the configured ElasticSearch index. This allows for some easy searching and visualisation of the findings. To learn more about Elasticsearch visit [elastic.io].
9
+
The ElasticSearch persistenceProvider saves all findings and reports into the configured ElasticSearch index. This allows for some easy searching and visualization of the findings. To learn more about Elasticsearch visit [elastic.io].
10
10
11
11
## Configuration
12
12
13
13
### Setting the Persistence Provider
14
14
15
-
The engine supports multiple different persistence providers. Each of the prepackaged persistence providers can be toggle on by using environment variables.
15
+
The engine supports multiple different persistence providers. Each of the prepackaged persistence providers can be toggled on by using environment variables.
16
16
17
-
The currently availible persistence providers are:
17
+
The currently available persistence providers are:
0 commit comments