Skip to content

Commit 3af5d97

Browse files
claudeclaude
committed
chore(security): add automated security scanning and dependency management
Add comprehensive security infrastructure with zero-cost tools: - **Dependabot**: Automated dependency updates - Weekly scans for npm and GitHub Actions - Grouped updates to reduce PR noise - Security updates always prioritized - **Security Workflow**: Multi-layered scanning - npm audit for vulnerability detection - CodeQL for static code analysis - Dependency review for PRs - Scheduled weekly scans - **SECURITY.md**: Vulnerability reporting policy - Responsible disclosure process - Security best practices for users - Supported versions and SLA commitments All tools are FREE for public repositories and require no additional cost. Addresses recommendations from repository analysis to improve: - Dependency vulnerability detection - Automated security updates - Supply chain security - Security incident response process
1 parent 9e562d8 commit 3af5d97

File tree

3 files changed

+360
-0
lines changed

3 files changed

+360
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
version: 2
2+
updates:
3+
# Enable version updates for npm
4+
- package-ecosystem: "npm"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
time: "09:00"
10+
# Limit number of open PRs to avoid overwhelming maintainers
11+
open-pull-requests-limit: 10
12+
# Add labels for easy filtering
13+
labels:
14+
- "dependencies"
15+
- "automated"
16+
# Group minor and patch updates together to reduce PR noise
17+
groups:
18+
development-dependencies:
19+
dependency-type: "development"
20+
update-types:
21+
- "minor"
22+
- "patch"
23+
production-dependencies:
24+
dependency-type: "production"
25+
update-types:
26+
- "patch"
27+
# Assign PRs to maintainer
28+
assignees:
29+
- "fergusbisset"
30+
# Increase pull request limit for security updates
31+
# Security updates are always created separately
32+
versioning-strategy: increase
33+
# Allow Dependabot to rebase PRs
34+
rebase-strategy: "auto"
35+
36+
# Monitor GitHub Actions for updates
37+
- package-ecosystem: "github-actions"
38+
directory: "/"
39+
schedule:
40+
interval: "weekly"
41+
day: "monday"
42+
labels:
43+
- "dependencies"
44+
- "github-actions"
45+
assignees:
46+
- "fergusbisset"

‎.github/workflows/security.yml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
name: Security Scanning
2+
3+
on:
4+
push:
5+
branches: [ main, master ]
6+
pull_request:
7+
branches: [ main, master ]
8+
schedule:
9+
# Run security scan every Monday at 9am UTC
10+
- cron: '0 9 * * 1'
11+
workflow_dispatch:
12+
13+
jobs:
14+
npm-audit:
15+
name: NPM Security Audit
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@v4
21+
22+
- name: Setup Node.js
23+
uses: actions/setup-node@v4
24+
with:
25+
node-version: '20'
26+
cache: 'npm'
27+
28+
- name: Install dependencies
29+
run: npm ci
30+
31+
- name: Run npm audit
32+
run: |
33+
echo "## NPM Security Audit Results" >> $GITHUB_STEP_SUMMARY
34+
echo "" >> $GITHUB_STEP_SUMMARY
35+
36+
# Run audit and capture output
37+
if npm audit --audit-level=moderate 2>&1 | tee audit.txt; then
38+
echo "✅ No vulnerabilities found!" >> $GITHUB_STEP_SUMMARY
39+
else
40+
echo "⚠️ Vulnerabilities detected - see details below" >> $GITHUB_STEP_SUMMARY
41+
echo "" >> $GITHUB_STEP_SUMMARY
42+
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
43+
cat audit.txt >> $GITHUB_STEP_SUMMARY
44+
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
45+
exit 1
46+
fi
47+
48+
- name: Check for outdated dependencies
49+
run: |
50+
echo "## Outdated Dependencies" >> $GITHUB_STEP_SUMMARY
51+
echo "" >> $GITHUB_STEP_SUMMARY
52+
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
53+
npm outdated || true >> $GITHUB_STEP_SUMMARY
54+
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
55+
continue-on-error: true
56+
57+
codeql:
58+
name: CodeQL Security Analysis
59+
runs-on: ubuntu-latest
60+
permissions:
61+
security-events: write
62+
actions: read
63+
contents: read
64+
65+
strategy:
66+
fail-fast: false
67+
matrix:
68+
language: [ 'javascript' ]
69+
70+
steps:
71+
- name: Checkout code
72+
uses: actions/checkout@v4
73+
74+
- name: Initialize CodeQL
75+
uses: github/codeql-action/init@v3
76+
with:
77+
languages: ${{ matrix.language }}
78+
# Optional: Add custom queries
79+
# queries: security-extended,security-and-quality
80+
81+
- name: Autobuild
82+
uses: github/codeql-action/autobuild@v3
83+
84+
- name: Perform CodeQL Analysis
85+
uses: github/codeql-action/analyze@v3
86+
with:
87+
category: "/language:${{matrix.language}}"
88+
89+
dependency-review:
90+
name: Dependency Review
91+
runs-on: ubuntu-latest
92+
# Only run on pull requests
93+
if: github.event_name == 'pull_request'
94+
95+
steps:
96+
- name: Checkout code
97+
uses: actions/checkout@v4
98+
99+
- name: Dependency Review
100+
uses: actions/dependency-review-action@v4
101+
with:
102+
# Fail the build if vulnerabilities are found
103+
fail-on-severity: moderate
104+
# Add comment to PR with results
105+
comment-summary-in-pr: always

‎SECURITY.md‎

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,209 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
We actively support the following versions of the NHS FDP Design System with security updates:
6+
7+
| Version | Supported |
8+
| ------- | ------------------ |
9+
| 0.0.x (alpha) | :white_check_mark: |
10+
11+
**Note:** This project is currently in alpha. Once we reach v1.0.0, we will maintain the current major version and the previous major version with security updates.
12+
13+
## Reporting a Vulnerability
14+
15+
We take security vulnerabilities seriously. If you discover a security vulnerability in the NHS FDP Design System, please report it responsibly.
16+
17+
### How to Report
18+
19+
**Please DO NOT report security vulnerabilities through public GitHub issues.**
20+
21+
Instead, please report vulnerabilities through one of the following methods:
22+
23+
1. **GitHub Security Advisories** (Preferred):
24+
- Navigate to the [Security Advisories](https://github.com/fergusbisset/nhs-fdp-design-system/security/advisories) page
25+
- Click "Report a vulnerability"
26+
- Fill in the details of the vulnerability
27+
28+
2. **Email**:
29+
- Send details to the repository maintainer
30+
- Include "SECURITY" in the subject line
31+
- Provide a detailed description of the vulnerability
32+
33+
### What to Include
34+
35+
When reporting a vulnerability, please include:
36+
37+
- **Type of vulnerability** (e.g., XSS, CSRF, injection, etc.)
38+
- **Full paths of source file(s)** related to the vulnerability
39+
- **Location of the affected source code** (tag/branch/commit or direct URL)
40+
- **Step-by-step instructions** to reproduce the issue
41+
- **Proof-of-concept or exploit code** (if possible)
42+
- **Impact of the vulnerability** - what can an attacker accomplish?
43+
- **Your contact information** for follow-up questions
44+
45+
### What to Expect
46+
47+
After you submit a vulnerability report:
48+
49+
- **Acknowledgment**: We will acknowledge receipt within **48 hours**
50+
- **Assessment**: We will assess the vulnerability and determine its severity within **5 business days**
51+
- **Updates**: We will keep you informed of our progress
52+
- **Resolution**: We will work to release a fix as quickly as possible:
53+
- **Critical vulnerabilities**: Patched within 7 days
54+
- **High severity**: Patched within 14 days
55+
- **Medium/Low severity**: Patched in next regular release
56+
- **Credit**: We will credit you in the security advisory (unless you prefer to remain anonymous)
57+
58+
## Security Best Practices for Users
59+
60+
When using the NHS FDP Design System in your applications:
61+
62+
### 1. Keep Dependencies Updated
63+
64+
```bash
65+
# Check for security vulnerabilities
66+
npm audit
67+
68+
# Update to latest patch versions
69+
npm update
70+
71+
# Update to latest version
72+
npm install @fergusbisset/nhs-fdp-design-system@latest
73+
```
74+
75+
### 2. Content Security Policy (CSP)
76+
77+
If you're using components with inline styles or dynamic content, configure your CSP headers appropriately:
78+
79+
```
80+
Content-Security-Policy:
81+
default-src 'self';
82+
style-src 'self' 'unsafe-inline';
83+
script-src 'self';
84+
```
85+
86+
**Note:** Some components may require `'unsafe-inline'` for styles. We're working to eliminate this requirement.
87+
88+
### 3. Server-Side Rendering (SSR) Security
89+
90+
When using SSR components:
91+
92+
- Always sanitize user input before passing to components
93+
- Use the SSR-safe variants (`/ssr` exports) in server contexts
94+
- Validate all data before rendering
95+
- Never trust client-provided data in server components
96+
97+
Example:
98+
```tsx
99+
// ❌ DON'T: Unsanitized user input
100+
<Header serviceName={userInput} />
101+
102+
// ✅ DO: Sanitize input
103+
import DOMPurify from 'isomorphic-dompurify';
104+
<Header serviceName={DOMPurify.sanitize(userInput)} />
105+
```
106+
107+
### 4. Accessibility & Security
108+
109+
Many security vulnerabilities arise from accessibility issues:
110+
111+
- Use semantic HTML (provided by our components)
112+
- Ensure proper ARIA labels
113+
- Validate form inputs
114+
- Use our form validation components
115+
116+
### 5. XSS Prevention
117+
118+
Our components escape user content by default, but:
119+
120+
- Never use `dangerouslySetInnerHTML` with user content
121+
- Sanitize any HTML before rendering
122+
- Use our built-in input validation components
123+
- Be cautious with `href` attributes in links
124+
125+
```tsx
126+
// ❌ DANGEROUS
127+
<Button href={userProvidedUrl}>Click me</Button>
128+
129+
// ✅ SAFE
130+
import { isValidUrl } from './utils';
131+
const safeUrl = isValidUrl(userProvidedUrl) ? userProvidedUrl : '#';
132+
<Button href={safeUrl}>Click me</Button>
133+
```
134+
135+
## Known Security Considerations
136+
137+
### Progressive Enhancement Behaviors
138+
139+
Our behavior layer (client-side enhancement) uses `data-*` attributes:
140+
141+
- Behaviors are opt-in and don't execute unless explicitly imported
142+
- No `eval()` or `Function()` constructors are used
143+
- All event handlers are properly scoped
144+
- Behaviors can be safely torn down with `teardownAll()`
145+
146+
### Design Tokens
147+
148+
Design tokens are generated at build time and injected as CSS variables:
149+
150+
- No runtime token generation
151+
- No user-controllable token values
152+
- Tokens are static and type-safe
153+
154+
### Data Visualization Components
155+
156+
D3 and visualization components:
157+
158+
- SVG elements are properly escaped
159+
- No user-controlled `<script>` injection
160+
- Data is validated before rendering
161+
- Use our provided data validation utilities
162+
163+
## Security Tools in This Repository
164+
165+
We use the following automated security tools:
166+
167+
- **Dependabot**: Automated dependency updates and vulnerability alerts
168+
- **npm audit**: Checks for known vulnerabilities in dependencies
169+
- **CodeQL**: Static analysis for security vulnerabilities
170+
- **Dependency Review**: Automated review of dependency changes in PRs
171+
172+
## Security Release Process
173+
174+
When we release a security fix:
175+
176+
1. **Private Fix**: We develop the fix in a private branch
177+
2. **Security Advisory**: We create a GitHub Security Advisory
178+
3. **Patch Release**: We release a patch version (e.g., 0.0.44 → 0.0.45)
179+
4. **Notification**: We notify users through:
180+
- GitHub Security Advisory
181+
- Release notes
182+
- npm security advisories (when published to npm)
183+
5. **Disclosure**: After users have had time to update (typically 30 days), we publish full details
184+
185+
## Scope
186+
187+
This security policy applies to:
188+
189+
- ✅ The `@fergusbisset/nhs-fdp-design-system` package
190+
- ✅ All components in the design system
191+
- ✅ Build tools and scripts that ship with the package
192+
- ✅ Documentation and example code
193+
- ❌ Third-party dependencies (report to their respective maintainers)
194+
- ❌ Applications built using this design system (your responsibility)
195+
196+
## Contact
197+
198+
For security-related questions that are not vulnerability reports:
199+
200+
- Open a [GitHub Discussion](https://github.com/fergusbisset/nhs-fdp-design-system/discussions)
201+
- Tag your discussion with "security"
202+
203+
## Acknowledgments
204+
205+
We appreciate the security research community and will acknowledge contributors who report valid security issues (with their permission).
206+
207+
---
208+
209+
**Last Updated**: 2025-01-22

0 commit comments

Comments
 (0)