Shortcut Plugin

Shortcut Plugin

Contextual software security microtraining for Shortcut stories, powered by the SecureFlag Knowledge Base.

This plugin adds a link to the SecureFlag Knowledge Base to the description of stories that mention security vulnerabilities, with relevant labs and technical information. Each reply includes an overview of everything a developer needs to know in order to understand and remediate a given type of vulnerability, including example code!

We know that not all developers are security professionals, so CWE (Common Weakness Enumeration) numbers for common vulnerabilities are mapped to the Knowledge Base, providing an easier to ingest description of the vulnerability.

Installation

This must be performed by either an administrator, security champion, or a user with similar permissions.
  1. Create an API Token.
    - Name it appropriately, e.g. 'SecureFlag Knowledge Base'.
    - Keep the token visible for now whilst performing the next steps.

  2. Open a Terminal with the curl tool available.
    - Run the following command, inserting your own token.
      unset HISTFILE curl -v -X POST https://shortcut-plugin.secureflag.com/register --data '{"token":"YOUR_TOKEN_HERE"}'

  3. In Shortcut, open the Integrations page.

  4. Find an open the Webhooks integration.

  5. Add a new webhook.

  6. Set the payload URL to https://shortcut-plugin.secureflag.com/webhooks. Leave the secret empty.

  7. Done!

Usage

Simply mention a software vulnerability by name or CWE number when making a story. If relevant training is found, then it will be appended to the bottom of the story description.

For example, CWE-327, CWE 327, sql injection are all valid.