MozillaSecurity / MozillaSecurity/FuzzManager
Token hardening.
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 208
- Forks
- 48
- Avg merge
- 23h 5m
- Merged PRs (30d)
- 2
Description
The current API token for crash reporting during fuzzing is an unrestricted token shared by all fuzzing instances and also used for local team members during ad-hoc fuzzing. In the event of a token leak, all crash and signature data on the server can be read.
Some possibilities for improvements:
Add capability for tokens to be write-only for use by fuzzing instances.Done- Implement token expiry to force rotation.
- Rate limit tokens to a reasonable maximum to prevent a leaked write-only token from flooding the server.
- Segment tokens by tool so tokens can only report crashes for the intended tool.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points; start by locating API token handling for fuzzing instances and the crash/signature access path. Choose and specify the expiry, rate-limit, or per-tool segmentation scope, then verify that a leaked token cannot read unrestricted crash or signature data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100