From 5fb544f7414ba87ced21f41777e66833d7283aa9 Mon Sep 17 00:00:00 2001 From: gearnode Date: Tue, 7 Jan 2025 19:27:01 +0100 Subject: [PATCH] Add dependency vulnerability alerts Signed-off-by: Bryan Frimin --- ...COD-003_dependancy_vulnerability_alerts.md | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 controls/application-security/source-code/COD-003_dependancy_vulnerability_alerts.md diff --git a/controls/application-security/source-code/COD-003_dependancy_vulnerability_alerts.md b/controls/application-security/source-code/COD-003_dependancy_vulnerability_alerts.md new file mode 100644 index 000000000..6455b821f --- /dev/null +++ b/controls/application-security/source-code/COD-003_dependancy_vulnerability_alerts.md @@ -0,0 +1,33 @@ +--- +id: "APP-SRC-003" +category: "application-security/source-code" +revision-version: 1 +revision-date: "2024-01-07" +estimate-time: "15m" +frameworks: + - name: "soc2" + sections: ["CC4.1", "CC8.1"] +--- + +## Purpose +It ensures your project stays secure and up-to-date without manual +tracking of dependencies. It also reduces the risk of using outdated +or insecure libraries in your codebase. + +## Implementation + +### Github + +1. Go to your repository on GitHub. +2. Click on the "Settings" tab. +3. On the left sidebar, click "Security & analysis". +4. Under "Dependabot alerts", ensure "Dependency graph" and + "Dependabot security updates" are enabled. +5. GitHub will now alert you to any vulnerable dependencies and + automatically open pull requests to fix them. + +## Evidence +- Screenshot of Dependabot configuration screen +- Sample of dependency update PRs +- Vulnerability alert history +