Skip to content

FIPS 140-3 validated password hashing — ADR, packaging, and build pipeline - #8469

Draft
aaronlippold wants to merge 197 commits into
masterfrom
feature/fips-compliant-password-hashing
Draft

FIPS 140-3 validated password hashing — ADR, packaging, and build pipeline#8469
aaronlippold wants to merge 197 commits into
masterfrom
feature/fips-compliant-password-hashing

docs(authn): cite the tracking card for the LDAP prefer-at disable

6c69c3c
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / SonarCloud succeeded Aug 16, 2026 in 4s

41 new alerts including 6 high severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

  • 6 high
  • 26 medium
  • 9 low

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 73 in packaging/test-infra/fips-ec2/spike/bench.js

See this annotation in the file changed.

Code scanning / SonarCloud

Temporary files should not be created in publicly writable directories High test

Make sure publicly writable directories are used safely here. See more on SonarQube Cloud

Check failure on line 69 in packaging/test-infra/fips-ec2/spike/bench.js

See this annotation in the file changed.

Code scanning / SonarCloud

Temporary files should not be created in publicly writable directories High test

Make sure publicly writable directories are used safely here. See more on SonarQube Cloud

Check failure on line 60 in packaging/test-infra/fips-ec2/main.tf

See this annotation in the file changed.

Code scanning / SonarCloud

Public network access to cloud resources should be disabled High test

Make sure allowing public network access is safe here. See more on SonarQube Cloud

Check failure on line 180 in libs/password-hash-vectors/src/malformed-corpus.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Password hashes should not be disclosed High

Make sure this bcrypt password hash gets revoked, changed, and removed from the code. See more on SonarQube Cloud

Check failure on line 192 in libs/password-hash-vectors/src/malformed-corpus.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Password hashes should not be disclosed High

Make sure this bcrypt password hash gets revoked, changed, and removed from the code. See more on SonarQube Cloud

Check failure on line 186 in libs/password-hash-vectors/src/malformed-corpus.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Password hashes should not be disclosed High

Make sure this bcrypt password hash gets revoked, changed, and removed from the code. See more on SonarQube Cloud

Check warning on line 575 in apps/backend/test/constants/users-test.constant.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium test

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 581 in apps/backend/test/constants/users-test.constant.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium test

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 587 in apps/backend/test/constants/users-test.constant.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium test

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 624 in apps/backend/test/constants/users-test.constant.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium test

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 63 in libs/password-hash-vectors/scripts/generate-vectors.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 75 in libs/password-hash-vectors/scripts/generate-vectors.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 26 in libs/password-hash-vectors/src/vectors.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 40 in libs/password-hash-vectors/src/vectors.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 133 in packaging/rpm/scripts/setup-build-deps.sh

See this annotation in the file changed.

Code scanning / SonarCloud

HTTPS should be enforced on HTTP clients following redirects Medium

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. See more on SonarQube Cloud

Check warning on line 221 in packaging/rpm/scripts/setup-build-deps.sh

See this annotation in the file changed.

Code scanning / SonarCloud

HTTPS should be enforced on HTTP clients following redirects Medium

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. See more on SonarQube Cloud

Check warning on line 153 in packaging/rpm/setup-rpm-build-env.sh

See this annotation in the file changed.

Code scanning / SonarCloud

HTTPS should be enforced on HTTP clients following redirects Medium

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. See more on SonarQube Cloud

Check warning on line 312 in packaging/rpm/setup-rpm-build-env.sh

See this annotation in the file changed.

Code scanning / SonarCloud

HTTPS should be enforced on HTTP clients following redirects Medium

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. See more on SonarQube Cloud

Check warning on line 314 in packaging/rpm/setup-rpm-build-env.sh

See this annotation in the file changed.

Code scanning / SonarCloud

HTTPS should be enforced on HTTP clients following redirects Medium

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. See more on SonarQube Cloud

Check warning on line 32 in apps/backend/seed-support/demo-seed-helpers.js

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 371 in apps/backend/test/constants/users-test.constant.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium test

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 402 in apps/backend/test/constants/users-test.constant.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium test

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 441 in apps/backend/test/constants/users-test.constant.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium test

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 454 in apps/backend/test/constants/users-test.constant.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium test

Review this potentially hard-coded password. See more on SonarQube Cloud

Check warning on line 466 in apps/backend/test/constants/users-test.constant.ts

See this annotation in the file changed.

Code scanning / SonarCloud

Credentials should not be hard-coded Medium test

Review this potentially hard-coded password. See more on SonarQube Cloud