Skip to content

style: normalize md files (LF + trim) #12666

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: dev
Choose a base branch
from

Conversation

astounds
Copy link

I've split the formatting changes into separate commits (or PRs) by file type for safer review:

  • ✅ Each change is still whitespace-only (git diff -w shows empty)
  • 📦 Grouped by MIME type all .md together
  • 🔍 Easier to revert/review per category

This commit only touches 280 md files

Copy link

DryRun Security

This pull request includes minor documentation updates related to issue templates and support documentation, with potential information disclosure risks in support and bug report templates, but also includes a positive security improvement in the security issue reporting guidance by directing users to a dedicated security reporting program.

Information Disclosure in Support Requests in .github/ISSUE_TEMPLATE/support_request.md
Vulnerability Information Disclosure in Support Requests
Description Similar to the bug report template, the support request template now instructs users to include docker compose logs, which can potentially expose sensitive system information if not carefully redacted.

- Docker Compose or Helm version (Output of `docker compose version` or `helm version`)
- DefectDojo version (see footer) or commit message: [use `git show -s --format="[%ci] %h: %s [%d]"`]
**Logs**
Use `docker compose logs` (or similar, depending on your deployment method) to get the logs and add the relevant sections here showing the error occurring (if applicable).
**Sample scan files**

Credential Delivery Information in docs/content/en/cloud_management/additional-cloud-instance.md
Vulnerability Credential Delivery Information
Description Documentation explicitly states that support team will deliver login credentials, which could potentially be leveraged in social engineering attempts by providing insight into the credential delivery process.

## Step 5: Confirm your Plan type and Billing Frequency
At the end of our process, you'll be put in touch with our sales team, who can accurately quote your new server. We recommend you select the Plan Type which has the server specifications you require for the new instance.
![image](images/request_a_trial_5.png)

Security Issue Reporting Guidance in .github/ISSUE_TEMPLATE/security_issue.md
Vulnerability Security Issue Reporting Guidance
Description The security issue template now explicitly directs users to use a dedicated security reporting program instead of GitHub issues. This is a positive security improvement that helps prevent public disclosure of potential vulnerabilities.

**DefectDojo security reporting program**
If you believe you have found a **security issue** in DefectDojo, please review the [disclosure policy](../../readme-docs/SECURITY.md) and submit your finding via our security reporting program.
Please, do not submit **security issues** via GitHub directly.

Information Disclosure in Bug Reports in .github/ISSUE_TEMPLATE/bug_report.md
Vulnerability Information Disclosure in Bug Reports
Description The bug report template now instructs users to include logs from docker compose, which can potentially expose sensitive system information. While not a direct code vulnerability, this documentation change could lead to inadvertent information disclosure if users are not careful about redacting sensitive details from logs.

- Docker Compose or Helm version (Output of `docker compose version` or `helm version`)
- DefectDojo version (see footer) or commit message: [use `git show -s --format="[%ci] %h: %s [%d]"`]
**Logs**
Use `docker compose logs` (or similar, depending on your deployment method) to get the logs and add the relevant sections here showing the error occurring (if applicable).
**Sample scan files**


All finding details can be found in the DryRun Security Dashboard.

@mtesauro mtesauro marked this pull request as draft June 22, 2025 17:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant