Open-source GitHub Action scans codebases for quantum-vulnerable cryptography in CI

·1 views

A free, open-source GitHub Action called pq-readiness-scorecard lets developers automatically scan their repositories for cryptographic vulnerabilities on every push or pull request. The tool grades post-quantum readiness on an A–F scale, flags classically broken algorithms like MD5, RC4, and 3DES, and generates a CycloneDX 1.6 cryptographic bill of materials (CBOM). It can be configured to fail builds when vulnerable crypto is detected, helping teams enforce cryptographic hygiene before code merges. The tool is relevant amid growing regulatory pressure from frameworks such as CNSA 2.0, DORA, and NIS2, which now mandate cryptographic risk management. A browser-based scanner is also available for quick checks without any CI setup.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Teams Can Automate AWS Approval Email Validation in CI/CD Pipelines

Approval emails in AWS-based pipelines are often assumed to work correctly but can silently fail after routine infrastructure changes such as secret rotations or region misconfigurations. A practical CI/CD pattern addresses this by spinning up a short-lived Docker container that mirrors the production release path, triggers a real approval email via SES, and polls a disposable inbox to verify the message arrived with correct content. Each test run uses an isolated, unique mailbox to ensure deterministic results and eliminate flakiness from shared staging inboxes. The check deliberately avoids mocking the mailer or swapping templates, so it validates the actual container wiring rather than a simulated version. This narrow end-to-end test can catch common failure modes early and prevent approval bottlenecks from delaying releases by hours.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Automate Python Security Scanning Using Bandit and GitHub Actions

Static Application Security Testing (SAST) allows developers to detect code vulnerabilities before deployment by analyzing source code directly. Bandit, an open-source tool maintained by the Python Packaging Authority, is purpose-built for Python and can flag issues such as hardcoded credentials, command injection risks, and unsafe library usage. Developers can install Bandit via pip and run it locally against any Python file to receive an immediate vulnerability report. By configuring a GitHub Actions workflow, Bandit scans can be triggered automatically on every push to the main branch, with results saved as downloadable artifacts. Embedding such automated checks into the CI/CD pipeline helps ensure security flaws are caught early and consistently, before code reaches production.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a React Login Page Using Reusable Components

A developer tutorial on DEV Community walks through constructing a login page for a Smart Budget Tracker app using reusable React components. The guide demonstrates how a parent Login component manages form state, validation, and submission logic, while child components like TextInput and Button render purely based on received props. A single handleChange function handles updates for both email and password fields using dynamic key assignment, avoiding the need for separate handlers. The Button component is shown serving dual roles — as a form submit trigger and as a navigation link — illustrating how prop-driven design reduces the need for redundant components. On successful authentication, the user token and details are stored in localStorage and the user is redirected to their dashboard.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Indian Student Builds AI Tools Platform Xedge in 3 Months With Near-Zero Budget

Harsha, a college student from India, launched Xedge, an AI tools platform, after feeling overwhelmed by the fragmented and disorganized state of existing AI tool directories. He envisioned a single ecosystem where users could discover, buy, sell, and build AI tools, templates, prompts, and automations in one place. With no prior web development experience beyond C language, he self-taught HTML, CSS, JavaScript, Python, and MySQL in under a month, then used AI coding assistants to accelerate development while manually reviewing the output. The platform has since attracted over 600 users, with Harsha spending virtually nothing beyond the cost of a domain name. Despite not yet generating revenue, he completed the project within three months and continues working toward a fully monetized version of Xedge.

0 comments Read more at DEV Community