GitGoat VS smee-client

Doron Guttman and Roei Ben-Harush @ [arnica], April 2023

The downside is that developers can choose to avoid using one of the controls above, such as enabling MFA. In that case, the developers will likely prefer to create a new account and the use git config user.email [personal_email] to add the stats to their accounts. It will require the company to work harder on mapping the author (from the git config) to the pusher of the code (arnica.io correlates this data in the GitHub user inventory, so it is possible to solve with some engineering work).

This meme was created by arnica.io, which solves it. The nice thing about it is that the continuous analysis of excessive permissions is free forever for unlimited users.

You can assess all GitHub app permissions on https://arnica.io. The excessive permissions are presented at the end of the data ingestion process. This is part of the freemium.

Pretty cool way to generate dummy data on GitHub, such as invite members, add them to Teams, commit code and secrets, raise & review PRs, and configure different branch protection policies (such as CODEOWNERS). Link: https://github.com/arnica-ext/GitGoat

Well, that will require a change in the smee-client as well. So maybe a follow-up?

Neat stuff - certainly this problem crops up quite a lot where an internal server needs to get GitHub webhook data.

In the past, I've had good luck using a webhook proxy. I've mostly just used https://smee.io/ which is simple and lightweight although seems to be mostly abandonware at this point. I dockerized it so that it could be used in a Kubernetes cluster, which was very useful for my GitHub Actions build cluster: https://github.com/ethomson/smee-client

There's also Hookdeck, which I haven't used in production, but have played around with, and it seems conceptually the same, but can be made more Enterprisey. Whether that's a bug or a feature is probably up to you.

Using the same probot/smee-client shipped by Probot we divert the webhook URL to one on localhost for the development application, and for the production application we will enter a custom route.