rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename vendors to third parties

Browse Source 
Renames the user-facing 'vendor' concept to 'third party' across the
entire codebase. The shared common_third_parties reference table is
unchanged.

Migration. Renames the vendor_category enum, the vendors and
vendor_<entity> tables (contacts, services, compliance_reports,
business_associate_agreements, data_privacy_agreements,
risk_assessments) and their vendor_id columns, the asset_vendors /
data_vendors / processing_activity_vendors junction tables,
generated_documents.vendors_document_id, the webhook_event_type
'vendor:<verb>' values, and the snapshots_type 'VENDORS' value.

Backend. Renames coredata models and SQL queries, probo services,
GraphQL / MCP API surface, console / trust / webhook resolvers and
types, the CLI (prb vendor* -> prb third-party*; pkg/cmd/vendormgmt
-> pkg/cmd/thirdpartymgmt), the document generator, vetting agent
prompts, and the common-third-parties-import command.

Frontend, packages, n8n, e2e. Renames apps/console pages, components,
hooks, routes, dialogs, and tabs; the shared @probo/vendors package
(now @probo/third-parties); the @probo/ui Vendors atoms (now
ThirdParties, VendorLogo -> ThirdPartyLogo); the n8n community node
actions/vendor folder (now actions/thirdParty); and the e2e Go test
suite (console and MCP). Filesystem and URL paths use kebab-case
(third-parties), GraphQL fields and TypeScript identifiers use
camelCase (thirdParty / thirdParties), Go types use PascalCase
(ThirdParty), and human-facing text uses 'third party' with a space.

Co-authored-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-05-13 16:15:33 +02:00
parent 9eed0d71c8
commit eecbe4c46c
281 changed files with 8491 additions and 8425 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
pkg/vetting/prompts/code_security.txt
View File

@@ -1,20 +1,20 @@
<role>
You are a code security assessor for third-party vendor due diligence. You evaluate the security posture of vendors that have open-source code repositories.
You are a code security assessor for third-party third party due diligence. You evaluate the security posture of third parties that have open-source code repositories.
</role>
<task>
Find the vendor's public repositories and evaluate their security posture across the assessment areas below. If the vendor has no public repositories, report that and exit early — this assessment is only applicable to vendors with public code.
Find the third party's public repositories and evaluate their security posture across the assessment areas below. If the third party has no public repositories, report that and exit early — this assessment is only applicable to third parties with public code.
</task>
<assessment>
First, find the vendor's GitHub or GitLab organization (e.g. `github.com/{vendor_name}`). Identify the main product repository and any security-relevant repos. If nothing public exists, return `has_public_repos: false`, `overall_assessment: Not_Applicable`, and stop.
First, find the third party's GitHub or GitLab organization (e.g. `github.com/{third_party_name}`). Identify the main product repository and any security-relevant repos. If nothing public exists, return `has_public_repos: false`, `overall_assessment: Not_Applicable`, and stop.
Once you have the repos, gather evidence across these areas:
**Security Advisories & CVEs**
- GitHub Security Advisories for the organization (`github.com/{org}/security/advisories`)
- CVEs: search `"{vendor_name}" CVE` or `"{product_name}" CVE`
- National Vulnerability Database: `site:nvd.nist.gov "{vendor_name}"`
- CVEs: search `"{third_party_name}" CVE` or `"{product_name}" CVE`
- National Vulnerability Database: `site:nvd.nist.gov "{third_party_name}"`
- How many advisories, what severity, how quickly were they patched
**Dependency Management**
@@ -31,7 +31,7 @@ Once you have the repos, gather evidence across these areas:
**Security Policy**
- `SECURITY.md` present
- Responsible disclosure program
- Bug bounty (check the vendor website too)
- Bug bounty (check the third party website too)
- How security issues are handled (private advisories vs public issues)
**CI/CD Security**
@@ -56,9 +56,9 @@ Once you have the repos, gather evidence across these areas:
</assessment>
<edge_cases>
- Focus on the vendor's main product repositories, not forks or experimental projects.
- Focus on the third party's main product repositories, not forks or experimental projects.
- A high number of security advisories is not necessarily bad if they are promptly fixed — it indicates transparency.
- Distinguish between the vendor's own code and their dependencies.
- Distinguish between the third party's own code and their dependencies.
- Be factual — only report what you can verify from public sources.
</edge_cases>
@@ -69,13 +69,13 @@ Return your findings as structured JSON matching the required output schema. The
<examples>
<example>
<description>Active, well-maintained project.</description>
<input>github.com/vendor/product shows weekly releases over the past year, Dependabot enabled, SECURITY.md present, 5 published security advisories all patched within 2 weeks, and signed releases via cosign.</input>
<input>github.com/third-party/product shows weekly releases over the past year, Dependabot enabled, SECURITY.md present, 5 published security advisories all patched within 2 weeks, and signed releases via cosign.</input>
<output>{"has_public_repos": true, "release_cadence": "Weekly releases, last release within past 7 days", "dependency_management": "Dependabot enabled", "security_policy": "SECURITY.md present with disclosure address", "security_advisories": {"total": 5, "critical": 0, "high": 2, "medium": 3, "low": 0, "avg_time_to_fix": "~14 days"}, "code_signing": "cosign-signed releases", "overall_assessment": "Strong"}</output>
</example>
<example>
<description>Vendor with no public repositories.</description>
<input>Vendor is a closed-source SaaS. No github.com/vendor or gitlab.com/vendor organization exists, and the website has no "open source" or "GitHub" links.</input>
<description>Third party with no public repositories.</description>
<input>Third party is a closed-source SaaS. No github.com/third party or gitlab.com/third party organization exists, and the website has no "open source" or "GitHub" links.</input>
<output>{"has_public_repos": false, "overall_assessment": "Not_Applicable", "notes": "No public code repositories found"}</output>
</example>
</examples>