{"action":"created","issue":{"url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/63","labels_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/63/labels{/name}","comments_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/63/comments","events_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/63/events","html_url":"https://github.com/h3xstream/find-sec-bugs/pull/63","id":92417998,"number":63,"title":"Improved hardcoded passwords and key detector","user":{"login":"formanek","id":2494913,"avatar_url":"https://avatars.githubusercontent.com/u/2494913?v=3","gravatar_id":"","url":"https://api.github.com/users/formanek","html_url":"https://github.com/formanek","followers_url":"https://api.github.com/users/formanek/followers","following_url":"https://api.github.com/users/formanek/following{/other_user}","gists_url":"https://api.github.com/users/formanek/gists{/gist_id}","starred_url":"https://api.github.com/users/formanek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/formanek/subscriptions","organizations_url":"https://api.github.com/users/formanek/orgs","repos_url":"https://api.github.com/users/formanek/repos","events_url":"https://api.github.com/users/formanek/events{/privacy}","received_events_url":"https://api.github.com/users/formanek/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-07-01T15:48:53Z","updated_at":"2015-07-10T05:15:01Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/h3xstream/find-sec-bugs/pulls/63","html_url":"https://github.com/h3xstream/find-sec-bugs/pull/63","diff_url":"https://github.com/h3xstream/find-sec-bugs/pull/63.diff","patch_url":"https://github.com/h3xstream/find-sec-bugs/pull/63.patch"},"body":"New version of the detector with higher accuracy. The most important change is that constant values are tracked to a given argument of password or key sink method using flow analysis instead of only guessing the link between constant and method. Heuristics is used to catch positives with too complicated flow, but in contrast to previous detector, fields with suspicious names are reported all for a class in one report and only if they were not reported by high-confidence analysis. More information such as hard coded source is added to the bug report (if available) too. I have also integrated OAuth detector into this one (just by altering configuration)."},"comment":{"url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/comments/120229842","html_url":"https://github.com/h3xstream/find-sec-bugs/pull/63#issuecomment-120229842","issue_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/63","id":120229842,"user":{"login":"h3xstream","id":593130,"avatar_url":"https://avatars.githubusercontent.com/u/593130?v=3","gravatar_id":"","url":"https://api.github.com/users/h3xstream","html_url":"https://github.com/h3xstream","followers_url":"https://api.github.com/users/h3xstream/followers","following_url":"https://api.github.com/users/h3xstream/following{/other_user}","gists_url":"https://api.github.com/users/h3xstream/gists{/gist_id}","starred_url":"https://api.github.com/users/h3xstream/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h3xstream/subscriptions","organizations_url":"https://api.github.com/users/h3xstream/orgs","repos_url":"https://api.github.com/users/h3xstream/repos","events_url":"https://api.github.com/users/h3xstream/events{/privacy}","received_events_url":"https://api.github.com/users/h3xstream/received_events","type":"User","site_admin":false},"created_at":"2015-07-10T05:15:01Z","updated_at":"2015-07-10T05:15:01Z","body":"I really liked this pull request. It is a long term implementation of taint detection. My previous implementation look very poor compare to this new system.\r\nI also discover many FindBugs API along the code review.\r\n\r\nI will remove the artifacts of the wobbly \"Replay\" mechanism I previously introduce. I will do minor contribution to thing like the list of transfer methods. Other than that, I don't see anything major change to come on my side. I will start to do some testing on large code base to see how it react.\r\n\r\nAgain.. You did a really great job!"}}