December 2015 Summaries

Leaked credentials in open source packages pose a significant risk, exposing users to potential security breaches and malicious activities. The problem is not new, but as code becomes more discoverable, it's essential to take proactive measures to prevent such incidents. To ensure proper security guidelines, developers should follow best practices outlined by Snyk, including avoiding wildcards in git add commands, naming sensitive files in .gitignore and .npmignore, encrypting or using environment variables when publishing from CI, and invalidating leaked credentials. As an open source consumer, while there's limited you can do to prevent security blunders, being proactive by auditing dependencies and setting up safety nets like git-secrets can help mitigate risks.

Snyk is a tool that helps developers find and fix known vulnerabilities in their Node.js dependencies, making it easier for attackers to track and exploit them. Snyk's goal is to make it easy for developers to fix security issues first, focusing on fixing security issues rather than just finding them. To secure a project, developers can install Snyk using npm and run its wizard, which guides them through several steps including matching dependencies against the vulnerability database, understanding and fixing each security issue found, suggesting direct dependency upgrades, and notifying users when a new remediation path is made available. Once vulnerabilities are fixed, developers can use Snyk test to avoid shipping with vulnerabilities in their CI/CD systems, snyk protect to patch vulnerabilities, and snyk monitor to remember which dependencies they use so they can be notified about newly disclosed vulnerabilities that affect them. Additionally, Snyk provides a feature for open source package creators to ensure they're not distributing vulnerabilities to their users.