Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Provide more documentation on source code protection

See original GitHub issue

In one of my jobs I expected harden-runner to fail the job as I overwrite the source code using sed in one of the shell steps. But nothing happened with egress-policy: audit

How does the source code protection work, what does it protect against exactly?

Will it warn / inform about source code being overwritten, or does it block the system call? Does that depend on the setting of the egress-policy?

Is it allowed to create new files, or I just can’t overwrite existing files? Is there a way to provide a white-list of files allowed to be overwritten by a certain step?

Keep on with the great work, thanks a lot for harden-runner

Issue Analytics

State:
Created a year ago
Comments:7 (4 by maintainers)

Top GitHub Comments

1reaction

stefreakcommented, Aug 25, 2022

I see! Thank you a lot for the quick explanation.

Maybe there can be a config option for the extensions, or a way to whitelist certain files at some point. But I do agree that it’s also very important to keep things simple. I’m okay with your chosen trade off for now 😃

In our case we have a lot of infrastructure code (kubernetes and terraform), maybe some people want to protect that too as the infrastructure might be an even more powerful attack vector.

0reactions

varunsh-codercommented, Nov 17, 2022

Closing this issue as done. Feel free to re-open if there is feedback on documentation. Thanks!

Top Results From Across the Web

Best Practices for Source Code Security | Endpoint Protector

Your source code protection policy should also involve documentation and training on secure coding practices and the incorporation of secure ...

Source Code Security Best Practices

Best Practice 1: Have clear security policies that include source code · Best Practice 2: Apply dedicated tools to prevent source code theft....

How to protect your source code from attackers - TechBeacon

To get the most comprehensive list of vulnerabilities, you must have access to the application's source code. If attackers gain access to source...

Source Code Protection Sample Clauses - Law Insider

The Receiving Party shall protect Confidential Information consisting of source code and related source code documentation from unauthorized use and disclosure ...

Guide to Protecting Source Code - Micro Focus

To protect against the most common types of source code leaks, companies should focus their efforts on the most common source of those...