Frogbot requires a JFrog environment to scan your projects. If you don't have an environment, we can set up a free environment in the cloud for you. Just run one of the following commands in your terminal to set up an environment in less than a minute.

The commands will do the following:

1. Install JFrog CLI on your machine.
2. Create a FREE JFrog environment in the cloud for you.

For macOS and Linux, use curl

curl -fL "https://getcli.jfrog.io?setup" | sh

For Windows, use PowerShell

powershell "Start-Process -Wait -Verb RunAs powershell '-NoProfile iwr https://releases.jfrog.io/artifactory/jfrog-cli/v2-jf/[RELEASE]/jfrog-cli-windows-amd64/jf.exe -OutFile $env:SYSTEMROOT\system32\jf.exe'" ; jf setup

After the setup is complete, you'll receive an email with your JFrog environment connection details, which can be stored as secrets in Git.

• Creating the frogbot-config.yml File

General

Frogbot uses JFrog Xray (version 3.29.0 and above is required) to scan your pull requests. It adds the scan results as a comment on the pull request. If no new vulnerabilities are found, Frogbot will also add a comment, confirming this.

The following features use the package manager used for building the project:

• Software Composition Analysis (SCA)
• Vulnerability Contextual Analysis

The supported package managers are:

• Go
• Gradle
• Maven
• .NET
• npm
• NuGet
• Pip
• Pipenv
• Poetry
• Yarn

How to use Pull Request scanning?

👮 Security note for pull requests scanning

When installing Frogbot using JFrog Pipelines, Jenkins, and Azure DevOps, Frogbot will not wait for a maintainer's approval before scanning newly opened pull requests. Using Frogbot with these platforms is therefore not recommended for open-source projects.

When installing Frogbot using GitHub Actions and GitLab however, Frogbot will initiate the scan only after it is approved by a maintainer of the project. The goal of this review is to ensure that external code contributors don't introduce malicious code as part of the pull request. Since this review step is enforced by Frogbot when used with GitHub Actions and GitLab, it is safe to be used for open-source projects.

Scan results

Software Composition Analysis (SCA), Vulnerability Contextual Analysis and Infrastructure as Code scans (IaC)

Frogbot adds the scan results to the pull request in the following format:

👍 No issues

If no new vulnerabilities are found, Frogbot automatically adds the following comment to the pull request:

👎 Issues were found

If new vulnerabilities are found, Frogbot adds them as a comment on the pull request. For example:

VULNERABLE DEPENDENCIES

SEVERITY	CONTEXTUAL ANALYSIS	DIRECT DEPENDENCIES	IMPACTED DEPENDENCY	FIXED VERSIONS
Critical	$\color{#3CB371}{\textsf{Not Applicable}}$	minimist:1.2.5	minimist:1.2.5	[0.2.4] [1.2.6]
High	$\color{#FF7377}{\textsf{Applicable}}$	protobufjs:6.11.2	protobufjs:6.11.2	[6.11.3]
High	$\color{#3CB371}{\textsf{Not Applicable}}$	lodash:4.17.19	lodash:4.17.19	[4.17.21]

INFRASTRUCTURE AS CODE

SEVERITY	FILE	LINE:COLUMN	FINDING
Critical	test.js	1:20	kms_key_id='' was detected
High	mock.js	4:30	Deprecated TLS version was detected

Secrets Detection

When Frogbot detects secrets that have been inadvertently exposed within the code of a pull request, it promptly triggers an email notification to the user who pushed the corresponding commit. The email address utilized for this notification is sourced from the committer's Git profile configuration. Moreover, Frogbot offers the flexibility to direct the email notification to an extra email address if desired. To activate email notifications, it is necessary to configure your SMTP server details as variables within your Frogbot workflows.

Automatic pull requests creation

Frogbot scans your Git repositories periodically and automatically creates pull requests for upgrading vulnerable dependencies to a version with a fix. Supported package management tools:

• Go
• Maven
• npm
• Pip
• Pipenv
• Poetry
• Yarn

Adding Security Alerts

For GitHub repositories, issues that are found during Frogbot's periodic scans are also added to the Security Alerts view in the UI. The following alert types are supported:

1. CVEs on vulnerable dependencies

2. Secrets that are exposed in the code

3. Infrastructure as Code (Iac) issues on Terraform packages