Security audit

Feature Request
1

A CLI or API, that would carry out a security audit on the Wappler project to detect common security issues, such as:

  1. Missed security restricts for API
  2. Missing Permission and Validations
  3. Credentials hard coded in API steps instead of env variables,
    etc,etc

This would be helpful when Integrating the CI/CD pipelines in DevSecOps or NoOps

2

Adding a couple of more checks that can be included here:

  1. Debug flag on
  2. Outputs on for Insert or Update Operations (Warnings)
  3. Cookies not set to Strict, samesite
  4. DB connections not using SSL
  5. Passwords not using hashing
  6. Comments in Pages
1 Like
3

Bump!!!

4

Bump!

5

Bump!

6

Bump!!!

7

When you realise at 3am that you forgot you enabled debug…

UyHrWY1

5 Likes
8

Hi @George @patrick,
any update on this feature?

2 Likes
9

Bump!!!

10

I voted on this a while ago, if this is possible it would be a great help so securing our work. I’ve just been through some stuff I did a good while ago and a lot of it had missing security on APIs - it was easy enough to sort out but having an overview given by an audit facility would be way clearer.

1 Like
11

Bump!!! :smiley:

2 Likes
12

Bump!!!

1 Like
14

Bump!!!

1 Like
15

Bump!!

16

Bump!!!

17

Bump!

18

If you're using Github, you can connect tools like Semgrep | Semgrep Code or https://www.jit.io/ to your repositories and find most vulnerabilities, including hard-coded credentials.

It won't find missing security restricts on APIs ootb, but I think you should be able to create custom rules for those.

Be prepared to find a lot of security issues though. :slight_smile:

19

Hi @kfawcett,

Thanks for the suggestion! Semgrep is a great tool, but it does have limitations when it comes to low-code platforms. Tools like Semgrep and NPM audit (for SAST and SCA) are important, for code vulnerabilities, dependency checks and license violation monitoring, to ensure security throughout CI/CD processes.

For Node.js projects, a strong alternative to Semgrep would be NodeJSScan or ndjscan CLI. I’ve published a forked version on PyPI that even supports exporting results in a DefectDojo-compatible format: https://pypi.org/project/cdmx-njsscan/

However to cover up those limitations we would still require the Security Audit feature,
Like the one n8n has:

20

AFAIK, there are NodeJSScan rules that can be used in Semgrep. I wonder if it would be worth creating Wappler rulesets and submitting them to the Semgrep registry.

https://semgrep.dev/explore