CzynszOK security checks: what runs on every change

On every code change CzynszOK runs several automatic security checks. Below is the list of what really runs and what the first run turned up. We write only what the configuration files in our repository confirm. The short version is also on the Security page.

What runs on every code change

• Dependencies: npm audit at the critical level. A finding fails the check.
• Secrets in code: gitleaks checks the files and commits of the change, and TruffleHog checks the whole repository history but reports only secrets it can verify as live. Both fail the check.
• Static code analysis: Semgrep with its default rule set. A finding at ERROR level fails the check.
• The running app: OWASP ZAP in baseline mode (we describe that mode in a separate post) scans the public pages of the app started without a database. New findings block the build, and the report of each run is saved with the run.
• Dependencies, known vulnerabilities: OSV-Scanner on every pull request and every week. A new known vulnerability blocks the build.
• Before and alongside: type checks, lint, gates that guard, among other things, the access rules of routes and no personal data in logs, plus unit and end-to-end tests.

Every week Dependabot opens grouped pull requests with the dependency updates it found (dependabot.yml); a weekly routine consolidates all open ones into a single pull request and works on it until every blocking check passes; a human merges it.

What the first run turned up

• OWASP ZAP: 61 checks passed, 0 failed.
• Semgrep (version 1.180.0, the same command as the check): found one issue in our encryption code and we fixed it. The AES-256-GCM decryption call did not state the length of the authentication tag. The code already rejected any tag other than 16 bytes, and now that length is set in the call itself too, for encryption and decryption.
• Dependency scan: flagged 4 vulnerabilities in developer tools; we upgraded the packages that had a fix.
• TruffleHog: found no live secret in the repository history.

What these checks do not do

ZAP in baseline mode is passive: it reads the server's responses, attacks nothing and does not log in, so it does not see the screens behind login. Semgrep looks for known patterns of mistakes, it does not prove that code cannot be bypassed. This is not a penetration test by people, and we have not published one. When there is one, we will describe it with its date and scope.

Frequently asked questions

Does CzynszOK hold an ISO 27001 or SOC 2 certificate?

No. The certificates we mention on the Security page belong to our vendors (database, hosting, payments, email) and we describe them as they publish them themselves.

Do these checks replace a penetration test?

No. They are automatic checks that run on every change. A penetration test is done by people, and we have not published one.

Do you scan the screens behind login?

The ZAP scan covers public pages. The screens behind login are protected by one-time-code login, access rules on every route and tests, but not by the ZAP scan.

Where do I report a security hole?

Write to pomoc@czynszok.pl: what you see and how to reproduce it. The same address is in our security.txt file.