Lol. Well thanks, as always, for taking a look! Your input is definitely appreciated. I considered adding a note to the initial announcement pre-thanking you for looking, and pre-apologizing for Sobelow not flagging anything in your app 
griffinbyatt
2
OvermindDL1
Lol!
I’m still awaiting it to flag something. I just made a huge amount of changes in a branch for the new redhat production deployment (I scan mainline, should probably scan everything), let me scan it right quick…:
╰─➤ mix sobelow
Error fetching version number.
##############################################
# #
# Running Sobelow - v0.5.1 #
# Created by Griffin Byatt - @griffinbyatt #
# NCC Group - https://nccgroup.trust #
# #
##############################################
Hardcoded Secret - High Confidence
File: config/prod.secret.exs - line 4
Type: secret_key_base
-----------------------------------------------
Hardcoded Secret - High Confidence
File: config/prod.secret.exs - line 8
Type: password
-----------------------------------------------
HTTPS Not Enabled - High Confidence
-----------------------------------------------
... SCAN COMPLETE ...
Well the prod.secret.exs is dynamically pulled from the environment, so unsure why it is saying it is hardcoded. Same thing on line 8 too (false positives).
As for HTTPS, that is no longer enabled in the app since it is running behind an nginx reverse proxy that handles HTTPS itself, so another false positive. ^.^
1
Desty
Very impressed with this tool. Just ran it on a pet project and it caught the hardcoded DB secrets. Curious to run it on our team’s repos tomorrow. Keep up the good work!
1
griffinbyatt
Is there a temporary string in prod.secret.exs or something? The scanner should correctly not report secrets pulled via functions like System.get_env or environment variables set with “${ENV}”. If you could PM me the results of running mix sobelow -v that would be very helpful!
Awesome! Glad you’re finding it useful 
0
OvermindDL1
Rather it gets generated from scripts to generate a prod.secret.exs file from a template file of prod.secret.exs.eex. The prod.secret.exs file itself is ignored by git. Perhaps sobelow should ignore the same files that .gitignore ignores?
0
griffinbyatt
Oh, that makes total sense! That’s something I’ll definitely look into. For a nearer-term solution, there is currently an --ignore-files flag you can use (more likely in a .sobelow-conf file than actually passed on the command line).
Thanks again!
0
OvermindDL1
Ooo, what is the format of the .sobelow-conf file so I can put that in?
Also, how can I have it ignore the HTTPS not enabled (not the entire prod.exs file) since nginx handles that?
0
griffinbyatt
The easiest thing you could do is:
mix sobelow -i Config.HTTPS --ignore-files config/prod.secret.exs --save-config
Then you can run with:
mix sobelow --config
The format is basically just a keyword list, but a --save-config is helpful to get it started
0
OvermindDL1
Nice! A config helper! Awesome!
Hmm, do you have to run it with --config or is that the default? It’d be nice not to specify it every time. ^.^
EDIT: Apparently have to use --config, how do we set that as the default?
Also now:
╰─➤ mix sobelow --config
zsh: correct 'sobelow' to '.sobelow' [nyae]? n
##############################################
# #
# Running Sobelow - v0.5.1 #
# Created by Griffin Byatt - @griffinbyatt #
# NCC Group - https://nccgroup.trust #
# #
##############################################
... SCAN COMPLETE ...
^.^
The .sobelow file it creates is a bit irritating, but eh… ^.^
0
griffinbyatt
Yes, currently running with --config is required because I didn’t want a case to arise where someone thought they were getting a full scan but they weren’t. So that might change in the future, and it could just have a warning that the scan is running with a config file.
But I’m not sure yet; I haven’t gotten a lot of feedback on the feature 
0