Preflight
Preflight helps you verify scripts and executables to mitigate chain of supply attacks such as the recent Codecov hack. First of all, it's the chicken and the egg. How do you pull a legit preflight binary from us without verifying it with preflight? The best way is to grab the source, compile it yourself, and use your own binary which you put in a place that you trust. People usually have several options of how to do that safely: Put it on your own S3 bucket, Drop it on your own Artifactory or similar, Push it directly into your repos (it should be as small as 4mb and almost never change so Git should work nicely with it), Build from source into your containers directly: FROM golang:1.16-alpine AS preflight_builder RUN apk add --no-cache git WORKDIR /builds RUN GOBIN=`pwd` go get -u github.com/spectralops/preflight # Build from a bare image, copy built binary FROM alpine:3.9 RUN apk add ca-certificates COPY --from=preflight_builder /builds/preflight /usr/local/bin # use preflight as you wish RUN curl https://.. |
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
GRFICS is a graphical realism framework for industrial control simulations using Unity 3D game engine graphics to enhance ICS security training.
An open source framework for security assessments of iOS apps, now decommissioned in favor of Objection.
A spam prevention technique using hidden fields to detect and deter spam bots in Laravel applications.
A cross-platform software library for interacting with iOS devices without jailbreaking.
Detects and handles potential malware in Microsoft Exchange 2019 messages with various techniques and third-party libraries.
DroidBox is a tool for dynamic analysis of Android applications, providing insights into package behavior and security.
Scans SPF and DMARC records for issues that could allow email spoofing.
Android application for learning about vulnerabilities in modern Android apps and testing pentesting skills.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.