Flags deep dive: Technology flags (Drifts for secure coding practices)

The platform provides a wide range of security code flags (based on OWASP guidelines), including broken access control, cryotographic failure, and more in this category.

When to use these Flags?

Leverage this flag to identify all the security drifts based on the specified conditions configured based on OWASP standards.

Technology.

Classification:

Code

Tools:

Atlassian Jira, Github, Gitlab, Bitbucket.

Intent:

The intent of this flag is to identify the drift in the codebase introduced in a Feature branch or a PR (based on a set of changes introduced in a bunch of files) based on the specified OWASP standards. The  check is done based on the following contexts:

1. The code introduced in the current Feature branch/Pull request/Merge request.
2. The data associated with the Feature branch/Pull request/Merge request.
3. The details associated with the linked Jira issue.
4. The outcome of analysis performed by the prediction engine (on the same set of conditions) in other PRs that the engineer has contributed (for a pattern).

The outcome of the aforementioned checks could result in an array of issues in the changes. The platform also provides the resolution path for every issue (which the engineer can copy and apply in the code base).

Configurations:

The configuration allows the Engineering manager/lead to define the scope of computation: 

1. The data source for analysis (Pull request, code branches or both).
2. The timespan (aks age) of selected data sources (Pull request, code branches or both).
3. Auto resolution settings: Enable this setting to auto-resolve the flag using one of the below mentioned options:
   1. Reporting the flag in Jira (for the entire flag or based on severity of issues in the flag).
   2. Notifying the workspace admins and assignees of the issue via email.
   3. Marking the entire flag as resolved as soon as they appear.
4. Compliance settings: Enable this setting to mark this a as a compliance flag; this will ensure the visibility of all the artefacts violating this flag in the compliance status report.