Manage Vulnerabilities allows you to perform the following tasks:

• Enable or disable vulnerability scanning for a repository to refine scanning report of the project.

• Auto enabling repositories for scanning vulnerabilities.

Enable/Disable a Repository for Vulnerability Scan

You can enable or disable a repository for vulnerability scanning in PCC from the Manage Vulnerabilities tab. If you enable a repository for vulnerability scanning, the repository is scanned for the vulnerabilities. If you disable the vulnerability scanning for a repository, the scanning will be skipped for the selected repository and vulnerabilities are not detected.

To enable or disable a repository for vulnerability scan, perform the following steps:

1.Login into PCC.

2. Search for the required project. The Project dashboard appears. Click Security from the LFX Tools tab.

3.The Security page appears. Click Manage Vulnerabilities tab, all repositories of the project are listed in alphabetical order.

4.Under Scan Vulnerabilities tab, toggle scan button to enable or disable a repository from scanning.

5. Under Last Scan Results tab, you can see whether the repository scan has been successful or failed while scanning the repository.

When the scan of the repository is successful, it is displayed as Successful and if there are any errors, it will be displayed as Failed.

Auto Enable Scanning of Repositories for Vulnerabilities

You have an option to auto enable scanning of repositories for vulnerability scanning when a new repository is added in the GitHub project. When you select the Auto enable option, all new repositories are scanned for the vulnerabilities.

You can the Auto Enable New Repositories toggle button to set the auto scanning of the new repositories. This button is available in the Manage Vulnerabilities tab.

The LFX Security tool provides automated vulnerability scanning and provides visibility into potential vulnerabilities to help projects address top security concerns.

The Security service tool allows you to perform the following:

• GitHub Onboarding

• Manage Vulnerabilities

• Manage False Positives

• Manage Inclusive Naming

For more information on Security Services, visit Security Documentation.

Manage false positives allows you to define few parameters and assign values to them which can be used to signal false positive at the time of scanning for code secrets. When you define a parameter as a false positive, you can easily detect these

Adding a False Positive Pattern

PCC Security tool allows you to add a false positive parameter which allows the

To add a false positive pattern, perform the following steps:

1.Login into PCC.

2. Search for the required project. The Project dashboard appears. Click Security from the LFX Tools STATUS tab.

3.The Security page appears. From the Manage False Positive tab, click Proceed.

4.The Manage False Positive page appears with the list of defined false positive parameters. Click Add False Positive Pattern to add a new false positive parameter.

5.The Add False Positive Pattern dialog box appears. There are three parameters that are available for you to select and define. After defining the parameter, click Add to add the parameter as false positive. The three parameters are:

• Path - Define the path for which you want to flag

• Secret Type - You can select the required secret type from the drop-down list. Some of the secret types are password assignment, JWT toke, AWS key and many other secret types are available for your to select.

• Secret Value - You should use a regular expression in order to define a value for Secret Value.

Security Bot Installation

Onboarding projects into LFX Security is done from the PCC (Project Control Center). As part of this onboarding, a Security Bot is installed on GitHub Organizations of the project.

To setup the Security service using PCC, perform the following steps:

1.Login into PCC.

2. Search for the required project. The Project dashboard appears. Click Security from the LFX Tools dropdown menu.

4.Enter the GitHub organization name in the Organization Name and click Connect.

5.The Install Security Bot on GitHub.org instructions page appears. You can read the instructions on how to install the Security Bot from this page. Click Install Security Bot button.

6. A list of GitHub organizations associated with the login account are listed and displayed. Select the required organization for which you want to install the Security bot.

7.The Install & Authorize LFX Security GitHub App page appears. This page provides the following information:

• Information on the permission requested for the selected repositories. The LFX Security requests the following permissions from the GitHub:

  • Read access to administer, code, check commit status, lookup members, and other metadata.

  • Read and write access to organization hooks, pull requests, and repository hooks.

  • Installing and authorizing LFX Security GitHub App grants these permissions on your account:

  • Read access to emails

• Access to the repositories. You can either provide access to all the repositories or selected repositories within the GitHub Organization.

Click Install & Authorize to install the LFX Security GitHub App.

8.The LFX Security Service GitHub app is installed successfully. You can see the installation success message.

9.In the PCC page, you need to click I'm Done Installing the Security Bot after completing the installation process.

10.You can see the list of GitHub organizations along with the repositories for which the Security bot has been successfully configured.

Security Bot Uninstallation

You can uninstall the security bot at any point of time from the PCC. When you uninstall the security bot, the security scanning for the GitHub organization is discontinued. You cannot see the vulnerabilities associated with your GitHub organizations.

To uninstall Security service from PCC, perform the following steps:

1.Login into PCC.

3.The Uninstall Security Bot on GitHub.org instructions page appears. You can read the instructions on how to uninstall the Security Bot from this page. Click Uninstall Security Bot button.

4.The LFX Security GitHub App opens in a new tab. Click Uninstall from the Danger Zone.

5. A pop message appears informing that the Security bot will be uninstalled for the selected repositories. Click OK to continue with the uninstallation process.

6.In the PCC page, you need to click I'm Done Uninstalling the Security Bot after completing the uninstallation process.

7.The GitHub repositories will be removed from the Security dashboard. But, you can see the GitHub organization name in the Security dashboard.

8.If you want to remove the GitHub organization completely from the Security dashboard, click Disassociate Organization.

9.A popup message appears informing that the GitHub organization will be disassociated. Click Disassociate to continue with the disassociation process.

Suspending Security Service

You have an option to suspend the Security service scanning without uninstalling the Security bot. When you suspend the Security service, the bot will not be uninstalled. You can revoke the suspension at any point of time by Unsuspending.

To suspend the Security service, perform the following steps:

1.Login into PCC.

3.The LFX Security GitHub App opens in a new tab. Click Suspend from the Danger Zone.

4.A popup message appears informing that the Security bot will be suspended. Click OK to continue with the suspension process.

5.The GitHub repositories are suspended from the Security dashboard.

Associating Individual Repositories to the Project

You can associate an individual repository to a project. PCC allows you to select an individual repository and allows you to assign it to a project.

To associate an individual repository, perform the following:

1.Login into PCC.

2.Select the required project and click Security from the LFX Tools dropdown menu.

3. Select the required individual repository from the Assigned to Project column that you want to assign to the project.

Adding Non Inclusive Words

You can add the words which depict people unfairly in an insulting manner and exclude people based on their ethnicity, gender or color. LFX will scan for these non inclusive words in the code. You refer Non Inclusive Language section for more information.

To add non inclusive words, perform the following steps:

1.Login into .

2. Search for the required project. The Project dashboard appears. Click Security from the LFX Tools STATUS tab.

3.The Security page appears. From the Manage Inclusive Naming tab, click Proceed.

4.Enter the non inclusive word in the Add word box and click +Add. The added non inclusive words are listed under NON-INCLUSIVE LANGUAGE.

Deleting Non Inclusive Words

To delete a non inclusive word, perform the following steps:

2. The Delete Keyword dialog box appears. Click Delete to confirm the deletion of the word.

A regular expression (regex or regexp) is a sequence of characters that specifies a search pattern. Usually such patterns are used by string-searching algorithms for "find" or "find and replace" operations on strings, or for input validation.

The below tables assists you on how to use different regular expressions:

Regular Expression Quantifiers

Regular Expression Groups

Regular Expression Character Classes

Regular Expression Assertions

Regular Expression Flags

Regular Expression Special Characters

Regular Expression Posix Classes

In certain scenarios, if the administrator wants to ignore specific secret types, secret values, or paths, they can do so by creating an ignore.yaml file. On creating the ignore.yaml file, the file should be placed into the root directory of the repository, within a .blubracket folder.

When a match of the ignore file is made, an alert will not be created (but an event will still be generated).

For example, below is a repository called Test1, which has a .blubracket folder and within the folder is the ignore.yaml file.

A sample .blubracket/ignore.yaml is provided below: