noseyparker
noseyparker copied to clipboard
Pull additional content when enumerating GitHub projects
Nosey Parker can enumerate repositories from GitHub given an organization or project name. Currently this only pulls down "regular" repositories. However, there are many additional bits of data that could enumerated and be pulled down for scanning:
- Gist repos
- Wiki repos
- Issues
- Pull Requests
- Actions artifacts and logs
- Discussions
- Comments (see this Truffle Security blog post for inspiration)
Adding support for scanning non-repo content listed above would require some new infrastructure. An obvious approach would be to save the JSON responses from enumerating those resources (issues, comments, etc) to the Nosey Parker datastore's scratch
subdirectory.
Also related: #40