Security Static Code Analysis
Hi, did you take into consideration using available static code security analysis tools to automatically discover vulnerabilities in code? Most of them are free and integrated with Github, so they can even create tasks/issues to fix open gaps in code.
Examples
- Snyk - https://snyk.io/test/ (free, does require only manifest file)
- LGTM - https://lgtm.com/ (free, does not support Go, but can be used for other components e.g. Lunie)
- WhiteSource Bolt - https://bolt.whitesourcesoftware.com/github/
- SonarCloud - https://sonarcloud.io/about
List of others
mre/awesome-static-analysis
Static analysis tools for all programming languages - mre/awesome-static-analysis
If you are asking about a security analysis of Tendermint and the Cosmos-SDK, multiple third party assessments have been done of those code bases – I would assume that those third parties were using either these tools or ones like them to catch the low-hanging fruit. Of course, each of those assessments was a point-in-time event, so your point still has merit from a continuous integration / assessment perspective. Having chatted a good deal with the security team at Tendermint (AIB), I would expect that they are doing something to this end.
Cheers,
Terry