LogoLogo
  • LFX Platform
  • Single Sign-On (SSO)
    • Create an Account
    • Sign in to Your Account
      • Sign in with Google
      • Sign in with GitHub
      • Sign in with LinkedIn
    • Manage Your Profile
    • Forgot Password
    • Have a question
    • Log Out
  • Individual Dashboard (MyProfile)
    • Release Notes
      • V0.7.0
      • V0.6.25 and V0.6.26
    • Quick Start Guide
      • Home Page
      • Profile
      • LF Events
      • Meetings
      • My Insights Beta Version
      • Purchases
      • Settings
    • Home Page
    • Share Your Experience- Help Us Improve
    • Profile
      • Badges and Skills
      • Open Source Event Speaking Experience
      • Technical Contributors
      • Linux Foundation & Project Issued Certifications
      • Training Enrollment
      • Community Roles
      • Supported Projects
    • Meetings
      • Find Your Host Key
    • My Insights Beta Version
    • LF Events
      • Registered
      • Past
      • Visa Letters
        • Updating Visa Letter Application
      • Travel Funding
        • Community Events Funding
    • Purchases
      • Coupons
      • Transactions
      • Individual Enrollments
      • Purchase a Linux.com Email
    • Data and Privacy
      • Data Visibility
    • Showcase your Maintainer Badges in LFX NOW!
      • Maintainer Badge LFX Support
      • What do I have to do as a Project Administrator?
    • Settings
      • Password
      • Manage Profile Visibility
      • Basic Information
      • Email Management
        • Email Preferences
      • My Work History
    • TUX Rewards FAQs
  • Insights
    • Insights
      • Release Notes
        • Release Version: V0.1.13
        • Release Version: V0.1.1
        • Release Version: V0.1.0
      • Unlocking Data-Driven Potential with Insights
      • Intended Audience
      • How does Insights help you?
      • Core Concepts
      • Activities Types
      • Getting Started
        • Accessing Insights
        • Home Page
          • Foundation Cards
          • Accessing the Foundation Overview Page
            • Foundation Overview
              • Project Ecosystem
              • Distribution of Projects
              • Project Velocity
            • Foundation's Projects
          • Project Cards
          • COCOMO: Cost Estimation Simplified
      • Project Overview Page
        • Filter the Date Range
        • GitHub
          • Key Metrics and detailed Analysis
            • Contributor
            • Commits
            • Issues
            • Pull Requests
            • Forks
            • Stars
          • Contributor Leaderboard
          • Contributor Dependency
          • Active Days
          • Organization Dependency
          • Organization Leaderboard
          • Contribution outside work hours
          • Geographical Distribution
        • Gerrit
        • Confluence
          • Organization Leaderboard
          • Contributor Leaderboard
          • Most Popular Pages
          • Activities Trend by the Week
          • Activity Breakdown
          • New Organizations
          • Drifting Away Organizations
          • New Contributors
          • Drifting Away Contributors
          • Geographical Distribution
        • Mailing Lists
          • What Is a Mailing List?
          • Key Metrics
          • New Contributors
          • Most Active Contributors
          • New Organizations
          • Most Active Organizations
          • Geographical Distributions
          • Top Mailing Lists
          • Popular Threads
          • Recent Messages
      • Velocity
        • Performance Metrics
        • Lead Time
        • Average Lead Time By Pull Request Size
        • Average Review Time By Pull Request Size
        • Average Wait Time For 1st Review
        • Code Review Engagement
      • Productivity
        • Commits Per Active Day
        • Work Time Distribution Impact
        • New Contributors
        • Drifting Away Contributors
        • Engagement Gap
        • Effort By Pull Request Batch Size
      • Reports
        • Contributors Reports
        • Organizations Reports
        • Activities
        • Retention
        • Project Health
          • Project Popularity
          • Contributor Diversification
          • What to Do When the Project Health Score is Low?
      • GitHub Vs. Git Metrics
      • Troubleshooting and FAQs
      • Glossary
  • Community Data Platform
    • Quick Start Guide
    • Accessing Community Data Platform
    • Project Groups Page
      • My project groups
    • Integrations
      • GitHub Integration
      • Git Integration
      • Gerrit
      • Groups.Io
      • Confluence
      • Slack
      • X/Twitter Integration
      • Reddit Integration
      • Discord Integration
      • LinkedIn Integration
      • Cvent Integration
      • Training and Certifications
      • Dev Integration
      • Hacker News integration
      • Stack Overflow
    • FAQs
  • Project Control Center
    • Release Notes
    • V2 (Latest Version)
      • Overview
      • Homepage
      • Reports
        • Health Metrics
          • Participating Organization
          • Net Promoter Score (NPS)
          • Membership Churn
          • Outstanding Balance
          • Events
          • Training and Certifications
          • Code Contributions
          • Board Meeting Participation
          • Mailing Lists
          • Marketing
        • Marketing Metrics
      • Operations
        • Project Definition
        • Membership
        • Domains
        • Cloud Providers
        • User permissions
      • Collaborations
        • Committees
          • Adding a Committee
          • Adding Members to a Committee
          • Sending Emails to Committee Members
          • Deleting a Member from a Committee
          • Managing Committees
        • Meetings
          • Scheduling a Meeting
          • Manage Meetings
          • Clone Meetings
          • Cancel Meetings
          • Add Documents to Past Meetings
          • Verify Meeting Participants
          • Sending Emails to Meeting Attendees
          • Meeting FAQs
        • Wiki
        • Issue Tracker
        • Voting
        • Mailing Lists
        • Surveys
      • Bookmarks
      • PCC FAQs
        • Meetings FAQs
    • V1 (Prior Version)
      • Release Notes
        • PCC V1.6.6 Release
        • PCC V1.6.5 Release
        • PCC V1.6.4 Release
        • PCC V1.6.3 Release
        • PCC V1.6.0 Release
        • PCC V1.5.1 Release
        • PCC - V1.4 Release
        • PCC - June 28/2022 Release
        • PCC - April 20/2022 Release
        • PCC - March 15/2022 Release
      • Overview
      • PCC Dashboard
      • Role-Based Access Control
        • Roles and Permissions for Project Setup
        • Roles and Permissions for IT Services
      • Adding a Main Project
      • Operations for a Project
        • Project Definition for a Project
        • Legal Setup for a Project
        • Membership Setup for a Project
        • Setting up a Domain for a Project
          • Transferring a Domain
          • Redirecting Your Domain
          • Adding a Service Record
          • Setting up the Email Services
        • Cloud Providers
      • Collaboration Services for a Project
        • Committees Setup for a Project
        • Mailing List
        • Issue Tracker for a Project
        • Setting up Wiki
        • Meeting Management
      • Development
        • Source Control
      • LFX Tools
        • Security
          • Onboarding Projects from GitHub
          • Manage Vulnerabilities
          • Manage False Positives
            • Regular Expressions Cheat Sheet
            • Ignore.yml File
          • Manage Non Inclusive Naming
        • EasyCLA
  • Organization Dashboard
    • Release Notes
      • Release v1.8.0
      • Release v1.7.0
      • Organization Dashboard - 03/July/2023 Release
      • Organization Dashboard - 03/October/2022 Release
    • What's New
      • Related Company Visibility
    • Learn About LFX Data
    • Introduction
    • Home page
    • Membership
      • Your Active Memberships
      • Renewing an Expired Membership
      • Discover New Open Source Project
    • Code Contributions
    • Training & Certifications
    • Events
      • Overview
      • Sponsorship Insights
      • Travel Funding
    • Access
    • Users FAQs
    • Profile
    • FAQs
  • Security
    • Release Notes
      • LFX Security V2.0.33 Release
      • LFX Security V2.0.32 Release
      • LFX Security V2.0.31 Release
      • LFX Security V2.0.30 Release
      • LFX Security V2.0.29 Release
      • LFX Security V2.0.28 Release
      • LFX Security V2.0.27 Release
      • LFX Security V2.0.26 Release
    • Overview
    • LFX Security FAQs
    • Onboarding your Project
    • LFX Security Requirements
      • Supported Languages
    • Add a Project to LFX Security
    • Open LFX Security
    • Authorization Page
    • Security Status Overview
    • Investigate and Remediate Vulnerabilities
    • Investigate Dependencies in the Application Dependency Tree
    • Get License Information
  • EasyCLA
    • V2
      • Releases and Known Issues
      • Getting Started
        • Prerequisites
        • EasyCLA Troubleshooting
          • EasyCLA Disabled
        • EasyCLA FAQs
        • EasyCLA Development Components
      • Project Managers
        • Sign in to Project Control Center
        • Set up Project on EasyCLA
        • Create New CLA Group
        • Update Template
        • Add or Remove a Project from CLA Group
        • View and Manage CLA Group Details
        • Add and Manage GitHub Organizations
        • Add and Manage Gerrit Organizations
        • Add and Manage GitLab Groups
        • View Connection Status of Git Organizations and Repositories
        • Enforce or Remove CLA Mechanism
        • Invalidate a Contributor's Signature
        • Uninstall the EasyCLA Application
      • Embargo, Sanction, and OFAC Compliance for Secure CLA Signing
      • Contributors
        • Individual Contributor
        • Corporate Contributor
      • Corporate CLA Managers
        • Sign in to the EasyCLA Corporate Console
        • Coordinate Signing CLA and become initial CLA Manager
        • Add or Delete CLA Managers
        • Approve and Manage Contributors
      • EasyCLA and Co-Author Compliance Guide
      • CCLA Signatories
        • Review and sign a Corporate CLA by Request
      • Configuring Merge Queue on GitHub for Branch Protection
      • Glossary
      • Corporate CLA Console
        • Dashboard
        • Projects
        • Manage your Profile
  • Mentorship
    • Program Schedule & Timelines
    • Platform Overview
      • View Mentorship Program Details
      • View Mentor/Mentee Profile
      • Toggle Between Mentorship and Crowdfunding
    • Administrators
      • Enroll Your Program
        • Mentorship Project Enrollment Form
      • Edit a Project
      • Open & Close Mentorship Applications
      • Add Mentors
      • View Mentee Profile
      • Manage Mentees Applications
      • Manage Mentees Tasks
      • Approve Mentee Stipends
      • Contact a Mentee
    • Mentees
      • Create Mentee Profile
      • Apply to Mentorship Program
      • Withdraw your Application
      • View your Application Status
      • Manage Your Tasks
      • Manage Your Mentorship Profile
      • Submit Expensify Report to Receive Mentorship Stipend
    • Mentors
      • Become a Mentor
        • Request to be Added to a Program
        • Admin Invites a Mentor to a Program
      • Review Mentees Applications
      • Manage Mentees Tasks
      • Contact a Mentee
      • Manage Your Mentorship Profile
    • Mentee Stipends
      • Total Stipend Amount
    • Mentee Guide
      • Introduction
      • How Mentorship Program Works
      • Benefits for Mentees
      • What Makes a Good Mentee
      • Am I Eligible to Become a Mentee?
      • How to Apply
      • Not Selected?
      • Start the Journey
        • What is Expected of You
        • Evaluations
        • How to Graduate Successfully
      • Additional Resources
      • Code of Conduct
      • Mentee FAQs
    • Mentor Guide
      • Introduction
      • Participant Roles
      • Getting Started
        • Why to Become a Mentor
        • Can I be a Mentor?
        • Benefits for Mentors
        • What Makes a Good Mentor
        • How to Select Mentees
      • Mentoring Best Practices
      • Maintain Open Source Culture
      • Start Mentoring
        • Create Project Plan and Prepare Mentees
        • Set Expectations
        • Managing the Project Plan
        • Mentee Evaluations
      • Additional Resources
      • Mentorship FAQs
      • Code of Conduct
    • Mentorship FAQs
    • Mentorship - Get Help
  • Crowdfunding
    • Dashboard Overview
      • Projects
      • Events
      • Travel Funds
      • Security Audit
      • General Funds
      • Integrated Services for a Project
      • Toggle Between Crowdfunding and Mentorship
    • Mandatory Compliance for Crowdfunding
    • Apply for Crowdfunding
      • Add a GitHub Project
      • Add a Git Project
      • Add a Project for Security Audit
      • Add General Fund
      • Add an Event
      • Add a Travel Fund
    • Donate/Sponsor
      • Donate as an Individual
      • Donate as a Sponsor
        • Add, Edit, or Delete an Organization
      • Sponsor Events
    • Register for an Event
    • Project Application
    • Event Application
    • Travel Fund Application
    • Security Audit Application
    • General Fund Application
    • Manage Your Crowdfunding Account
    • Get Reimbursed
    • Submit Travel Funding Reimbursement Expensify Report
    • Create and Submit an Expensify Report
    • Crowdfunding FAQs
    • Crowdfunding - Get Help
  • Linux Foundation Individual Supporter Program
    • Enroll in the Linux Foundation Individual Supporter Program
    • Purchase Lifetime Linux.com Email Alias
Powered by GitBook

Copyright © 2022 The Linux Foundation®. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks.

On this page
  • Security Overview Dashboard
  • CVSS Vulnerability Prioritization
  • Security Overview Page
  • Accessing the Overview Security Page
  • CVV Score
  • Secrets and Compliance Risk Score
  • Secrets and Compliance Risk Score
  • CII Best Practice Score
  • Project Criticality
  • Code Secrets Detected
  • Recent Alerts
  • Non Inclusive Language
  • Vulnerabilities Detected
  • Version Tree and Language Details

Was this helpful?

Edit on GitHub
Export as PDF
  1. Security

Security Status Overview

PreviousAuthorization PageNextInvestigate and Remediate Vulnerabilities

Last updated 7 months ago

Was this helpful?

Security Overview Dashboard

The Overview dashboard provides a comprehensive view of security issues and history for all repositories in your project, making it easy to identify and prioritize vulnerabilities.

CVSS Vulnerability Prioritization

The Common Vulnerability Scoring System (CVSS) calculates the severity of vulnerabilities discovered in your project repositories, providing a clear prioritization of remediation activities. CVSS scores are based on the National Vulnerability Database (NVD) and are classified into HIGH, MEDIUM, and LOW severity levels for easy reference.

Security Overview Page

The Security Overview page provides key information on your project's security posture, including:

  • CVSS Score: A numerical score indicating the severity of vulnerabilities discovered in your project repositories.

  • Secrets and Compliance Risk Score: A score indicating the risk of secrets and compliance issues in your project.

  • CII Best Practice Score: A score indicating the adherence of your project to best practices for security and compliance.

  • Project Criticality Score: A score indicating the criticality of your project's security posture.

  • Recent Alerts: A list of recent security alerts and notifications.

  • Vulnerabilities Detected: A donut and bar chart displaying the number of projects.

  • Version Tree: A visual representation of your project's version history.

  • Language Detail: A pie chart showing the distribution of programming languages used in your project.

Accessing the Overview Security Page

To access the Security Overview page, perform the following:

  1. Login into LFX Security.

  2. The Landing page appears. Go to your required project and click View Dashboard.

  1. By default, you will see the Overview page.

CVV Score

LFX Security uses the Common Vulnerability Scoring System (CVSS) as a standard measurement for the severity of vulnerabilities. This score is the average of CVSS scores for all repos in the project.

Secrets and Compliance Risk Score

LFX Security with collaboration from BluBracket provides this Secrets and Compliance Risk Score for each project. This score is the average of normalized Risk Scores for all repos in this project.

Secrets and Compliance Risk Score

Secrets and Compliance Risk Score This is the average of Normalized Risk Scores for all repos in this project.

CII Best Practice Score

CII Best Practices Badge

The Linux Foundation Core Infrastructure Initiative (CII) Best Practices badge is a way for Free or Libre and Open Source Software (FLOSS) projects to demonstrate adherence to best practices. Projects can voluntarily self-certify by using this web application to explain how they follow each best practice.

Best Practice Score

The score provides the following information:

  • Percentage of best practices followed by your project

  • Status of each best practice

  • Click on the score to view detailed information on the CII Best Practice, including:

    • Description of the best practice

    • Explanation of how your project follows the best practice

    • Links to relevant documentation or resources

Project Criticality

A project's criticality score defines the influence and importance of a project. This score provides you information on how critical is your project. Along with the critical score, it also provides other information such as:

  • Number of contributors to the project

  • Provides you with the age of the project

  • Information on the recent releases

  • Number of months when the project was last updated

  • Number of dependents of your project

Code Secrets Detected

Code Secrets Detected donut chart provides you the number of code secrets detected in the project. It shows you various code secrets detected in the project. On click of the detected code secret, the page navigates to the Code Secret details page.

Recent Alerts

Recent Alerts provides a list of code secrets alerts. This list includes information on the types of code secrets detected across various repositories.

Non Inclusive Language

The Non Inclusive Language cloud chart displays the list of non inclusive words that are used in the project.

Vulnerabilities Detected

Dependency Issues Over Time **** shows a timeline of when security issues occurred and how many issues occurred at a certain time. Lines and icons in the timeline are colored to represent threat levels. Vulnerabilities Detected **** shows number of vulnerabilities according to their severity level.

You can also filter the issues based on Total Issues, Fixed Issues, Fixable Issues and Open Issues.

Use this information to prioritize your investigation and remediation. To prioritize vulnerabilities, you might target one high-threat issue first. Additionally, it is important to focus on threats detected multiple times in the scanned code. Resolving one of these issues can make a marked difference in the security of the overall codebase.

Version Tree and Language Details

A version tree is a graphical representation of the version details for a particular repository. As and when the changes are updated for the repository, a new version of the repository is created. The version tree provides details such as version number, updated date, and time.

By default, the version tree shows version information from the beginning of GitHub organization.

Language details is a graphical representation of the different code languages such as Go, Typescript, SCSS, HTML, PLpgSQL, shell and other languages available in the repository. Language details provides a pie chart that shows the code breakup percentage of the language for the GitHub repository. This percentage helps you to identify the various language used and the percentage of that language used in the repository.

For more information, see .

https://www.bestpractices.dev/en
Security Overview
View Dashboard
CVSS Score
Secrets & Compliance Risk Score
CII Best Practice
Project Criticality Score
Code Secrets Detected
Recent Alerts
Non Inclusive Language
Vulnerabilities Detected
Version Tree
Language Details