We are excited to introduce you to the latest version of Endor Labs and endorctl - v1.6.273. This release includes new features and enhancements.
New Features
Detect GitHub Actions (Beta)
Endor Labs provides comprehensive visibility into GitHub Action workflows used in your code repositories and helps you to:
- Assess the authenticity and reliability of the dependencies in your CI environment. This enables you to determine potential exposure to known or headline incidents.
- Ensures that the code in your CI workflows does not change without your knowledge. This reduces breaking changes and helps you manage your supply chain risks.
- Detect and identify if any vulnerable or malicious software is part of your CI environment. For more information, see View GitHub Action findings.
To detect and view GitHub Action findings, run the endorctl scan with the --ghactions
flag.
For more information, see endorctl scan command.
Enhancements
Dashboard widgets
Endor Labs introduces new widgets on the Dashboard to help you track the development hours and the cost metrics of your organization.
- The newly introduced Vulnerability Prioritization Funnel systematically assesses and categorizes vulnerabilities based on their severity and category. By applying this funnel approach, organizations can prioritize addressing the most critical, exploitable, and actionable vulnerabilities first, maximizing their security efforts.
- Visualize Dev Hours Saved and Cost Saved metrics on the dashboard to make more informed decisions, optimize resource allocation, and better manage project budgets.
For more information, see View Dashboards.
Support for .NET Prop files (Beta)
Endor Labs now provides the support to scan the following .NET Prop files.
- Package references in
Directory.Build.props
orDirectory.Packages.props
files. - Package references in any
*.props
file and the prop file is imported in the*.csproj
file. - Package references in
*.Targets
file
For more information, see Scan .NET projects
npm for Windows operating systems
You can now use npm to install endorctl on Windows operating systems.
For more information, see Install endorctl with npm
Finding policies for Source Code Posture Management
The following new out-of-the-box finding policies are included in the application for source code posture management (SCPM).
Policy | Severity |
---|---|
Restrict the use of runner groups for public repositories | High |
Restrict runner groups to specific repositories | Medium |
Restrict the use of runner groups for public repositories | High |
Script injection detected in github workflow files | High |
Organization webhooks must be configured with a secret | Medium |
Repository webhooks must be configured with a secret | Medium |
Default workflow token permission should be read only | High |
Restrict general action permissions to organization members | High |
Default member permissions should be restricted | Medium |
For more information, see SCPM Policies.
endorctl commands
Note the updates to the following flags used with the endorctl scan.
Flag | Environment variable | Description | Usage |
---|---|---|---|
--dependencies |
ENDOR_SCAN_DEPENDENCIES |
Scan commits and generate findings for all dependencies. | Using this flag will generate findings for dependencies only. Previously it was generating findings for tools and dependencies. To fetch findings for both tools and dependencies, run the endorctl scan with --tools and --dependencies . |
--github |
ENDOR_SCAN_GITHUB |
Scans GitHub repositories and generates findings for GitHub misconfigurations. | Using this flag will generate findings for misconfigurations only. Previously it was generating findings for misconfigurations, tools, and dependencies. |
--tools |
ENDOR_SCAN_TOOLS |
Scans repositories and generates findings for CI/CD tools used in the source code repository. | Using this flag will generate findings for CI/CD tools only. Use it with --github to include GitHub app. It requires a valid github token with read:org access . |
--pr-incremental |
ENDOR_SCAN_PR_INCREMENTAL |
Scan packages with dependencies that have changed compared to the baseline scan | Use it with --pr-baseline or --enable-pr-comments to perform an incremental scan by ignoring any packages that have the same dependencies as the baseline. |
For more information, see endorctl scan command.
Dependency reachability
Note the following updates when you perform a deep scan for the following languages:
-
Python - The dependencies that are used in source code but not declared in the package’s manifest files are detected by default when you perform a deep scan on Python projects.
-
JavaScript/TypeScript - You must include the flag
--call-graph-languages
with valuejavascript,typescript
to detect dependencies that are used in the source code but not declared in the JavaScript or TypeScript package’s manifest files.
The flag --phantom-dependencies
and its corresponding environment variable ENDOR_SCAN_PHANTOM_DEPS
is deprecated from this release.