How to address security for white-label web app
-
I just started working with a business that made a web application that has a nodejs-expressjs backend api and a react front end. The business wants to sell its software as a white label solution to some enterprise sized businesses. My manager says that the customers will be expecting a detailed report to convince them that our solution is "secure". I need to determine steps to producing such a security report. My first thoughts are to follow these steps: 1. Run the `npm audit` command on our backend and front end projects to identify all known vulnerabilities. And then fixed them according to recommended approaches I read about on the internet. This step has been done. The `npm audit` command shows no vulnerabilities or issues of any kind. 2. We upload our code as docker images to dockerhub.com. Dockerhub shows a list of vulnerabilities for us to address. I am currently in this step, and I have some issues which I will elaborate further down in this post. 3. Hire a 3rd party cyber security firm to test our solution. This firm will give us a report of issues to address. That's my overall plan. However, I am currently stuck on step 2. Dockerhub is showing me **MANY** Critical and High priority vulnerabilities such as the following: - cve-2021-44906 - An Uncontrolled Resource Consumption flaw was found in minimist https://access.redhat.com/security/cve/cve-2021-44906 - CVE-2022-37434 - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. https://nvd.nist.gov/vuln/detail/CVE-2022-37434 ...etc... According to dockerhub, there are about 100 of these types of vulnerabilities, where maybe 10% are critical, 15% are high, rest are medium or low. These issues look very difficult to address, because they are used by modules of modules that I don't directly access in my own software. Trying to replace these modules of modules basically means a complete rewrite of our software to not depend on ANY open source solutions at all! And I'm sure if I were to scan packages with another type of scanner, different sets of vulnerabilities would be exposed. And I haven't even gotten to step 3 yet. So this got me wondering...how do other organizations selling white labelled solutions go about disclosing vulnerabilities to their end clients and how do they protect themselves? I started thinking that maybe I don't have to deal with every single security vulnerability that exists. Instead, I should only addres