PROGRESS :
This week was full of tests and coding. I raised my first pr for the local validation for the new cli publish pipeline for plugins : All: Resolves #15595: Added local validations for new publish workflow for plugin ecosystem by akshajrawat · Pull Request #15596 · laurent22/joplin · GitHub
Furthermore,
I ran many tests on codeql , semgrep ,socket dev and made a deep flow based threat model for SAST and SCA scanning. Here is a deep study of all the tools : Plugin Security Tool Comparison -- CodeQL, Semgrep & Gemini CLI
I completed the structure code for the scanning CI for the plugin repository and made it working : [Plugin Submission] joplin-plugin-test v1.0.0 · Issue #4 · akshajrawat/plugins-test · GitHub
Next Week Scope
-
Test & refine the threat model : Continue doing more tests for SAST tools and figure out more attack vectors to flag in the threat model.
-
Refine the scanning pipeline : Test all the edge cases of the scanning CI and refactor the code in more reusable and better way.
Problem Faced
Tool testing and knowing what actually we have to test and we need is kinda hard.. though I'm figuring my way out of it !