Secfoo Hackathon: start here #58

Welcome! This issue lists everything open for the hackathon.

Setup: follow CONTRIBUTING.md: pip install -e ".[dev]", then pytest tests and ruff check ..

Claiming an issue: comment "I'd like to take this" on the issue and a maintainer will assign you. One issue per person at a time, please. If there's no PR within 5 days, the issue goes back in the pool.

Core CLI

• Let users choose the model for each agent #45 Per-agent model selection
• SARIF output for secfoo findings export #46 SARIF output for secfoo findings export
• Support GitLab and Bitbucket repository URLs as targets #47 GitLab and Bitbucket URL targets
• Use a distinct exit code when a run stops at --max-cost #48 Distinct exit code when --max-cost is exceeded (good first issue)
• api agent: pre-flight prompt-size cap, and a distinct exit code when --max-cost is exceeded #32 Pre-flight prompt-size cap for the api agent
• New agent adapter: add support for another coding-agent CLI #49 New agent adapter:
• Docs: per-agent setup and troubleshooting guide #50 Docs: per-agent setup and troubleshooting guide (good first issue)

Custom skills

• Custom skills: add your own skills without changing code #79 Add your own skills without changing code: user and team skill folders, secfoo skills commands, and custom skills in the dashboard
• Dashboard for custom skills: render any skill's output dynamically #92 Dashboard for custom skills: render any skill's output dynamically (findings, filters, lifecycle, finding detail)
• Run your own skill from anywhere: --skill-file with URLs, and shared skill packs #93 Run your own skill from anywhere: --skill-file with URLs, shared skill packs with pinning

Runtime sensor for SCA (tracking issue: #51)

An opt-in sensor, deployed explicitly (e.g. as a sidecar) with the same Secfoo API key used for scans, that runs alongside a threat-modeled or assessed app, in any runtime and on any platform, and confirms whether vulnerable dependencies are loaded, executed and reached by live traffic. Read #51 first for the design rules. Agree on the formats in #52, #53 and #73 before building on them.

Phase 1: offline evidence

• Build a vulnerable-function watchlist from advisories #52 Vulnerable-function watchlist from advisories
• Runtime evidence format, storage and secfoo runtime ingest #53 Runtime evidence format, storage and secfoo runtime ingest
• Import coverage files as runtime evidence #54 Import coverage files as runtime evidence (good first issue)
• Python live sensor (sys.monitoring) #55 Python probe (sys.monitoring)
• Node.js live sensor (--require hook) #56 Node.js probe (--require hook)
• Runtime evidence in the SCA dashboard #57 Runtime evidence in the SCA dashboard

Phase 2: live sensor

• Runtime ingest API: sensors use your Secfoo API key #66 Live ingest API and sensor tokens
• Standalone runtime sensor (secfoo sensor) as sidecar or host daemon #67 Standalone sensor (secfoo sensor): sidecar, host daemon or Lambda extension
• Runtime package inventory: loaded versions, drift and live advisories #68 Runtime package inventory: loaded versions, drift and live advisories
• Attribute runtime hits to live traffic (route, auth state) #69 Attribute hits to live traffic (route, auth state)
• Correlate live traffic with the threat model's entry points #70 Correlate live traffic with the threat model's entry points
• Deploy the runtime sensor anywhere: containers, Kubernetes, VMs, Windows, PaaS, serverless #71 Deploy anywhere: containers, Kubernetes, VMs, Windows, PaaS, serverless
• Runtime page: sensor health, live activity and alerts #72 Runtime page: sensor health, live activity and alerts
• Probe ↔ sensor protocol and conformance kit (one contract for every runtime) #73 Probe ↔ sensor protocol and conformance kit
• Runtime evidence at the developer stage: CLI, SARIF and CI gate #80 Runtime evidence at the developer stage: CLI, SARIF and CI gate

Phase 3: more runtimes (each needs #73)

• JVM probe (-javaagent): Java, Kotlin, Scala #74 JVM probe (Java, Kotlin, Scala)
• .NET probe: startup hook + CLR profiler #75 .NET probe
• Go, Rust and native binaries: inventory from build metadata, hits via uprobes #76 Go, Rust and native binaries
• Ruby probe (TracePoint): Rails, Sinatra, Rack #77 Ruby probe
• PHP probe: observer-API extension + no-extension mode #78 PHP probe

Questions: ask in the issue thread.