Security Static Code Analysis

[Norrin]

Hi, did you take into consideration using available static code security analysis tools to automatically discover vulnerabilities in code? Most of them are free and integrated with Github, so they can even create tasks/issues to fix open gaps in code.

Examples

• Snyk - https://snyk.io/test/ (free, does require only manifest file)
• LGTM - https://lgtm.com/ (free, does not support Go, but can be used for other components e.g. Lunie)
• WhiteSource Bolt - https://bolt.whitesourcesoftware.com/github/
• SonarCloud - https://sonarcloud.io/about

List of others

mre/awesome-static-analysis

[drzow]

If you are asking about a security analysis of Tendermint and the Cosmos-SDK, multiple third party assessments have been done of those code bases – I would assume that those third parties were using either these tools or ones like them to catch the low-hanging fruit. Of course, each of those assessments was a point-in-time event, so your point still has merit from a continuous integration / assessment perspective. Having chatted a good deal with the security team at Tendermint (AIB), I would expect that they are doing something to this end.

Cheers,
Terry