Skip to content

Commit 3781f13

Browse files
clewellyn-navaclewellyn-nava
committed
fixing changes, add security
1 parent a4349bc commit 3781f13

6 files changed

Lines changed: 41 additions & 93 deletions

File tree

‎.gitleaks.toml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,5 @@ useDefault = true
1111
regexTarget = "match"
1212
description = "whitelist public and test secrets"
1313
regexes = [
14-
'''a''',
15-
'''b''',
16-
'''c''',
14+
'''abcdefghijklmnoppleasechange''',
1715
]

‎COMMUNITY.md‎

Lines changed: 1 addition & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -44,84 +44,7 @@ The members of bluebutton-sample-client-python-react community are responsible f
4444
Total number of contributors: <!--CONTRIBUTOR COUNT START--> <!--CONTRIBUTOR COUNT END-->
4545

4646
<!-- readme: contributors -start -->
47-
<table>
48-
<tbody>
49-
<tr>
50-
<td align="center">
51-
<a href="https://github.com/JFU-NAVA-PBC">
52-
<img src="https://avatars.githubusercontent.com/u/135686833?v=4" width="100;" alt="JFU-NAVA-PBC"/>
53-
<br />
54-
<sub><b>Jim Fuqian</b></sub>
55-
</a>
56-
</td>
57-
<td align="center">
58-
<a href="https://github.com/ajshred">
59-
<img src="https://avatars.githubusercontent.com/u/84713593?v=4" width="100;" alt="ajshred"/>
60-
<br />
61-
<sub><b>Adrian Jones</b></sub>
62-
</a>
63-
</td>
64-
<td align="center">
65-
<a href="https://github.com/dtisza1">
66-
<img src="https://avatars.githubusercontent.com/u/36048547?v=4" width="100;" alt="dtisza1"/>
67-
<br />
68-
<sub><b>David Tisza</b></sub>
69-
</a>
70-
</td>
71-
<td align="center">
72-
<a href="https://github.com/gmaciolek">
73-
<img src="https://avatars.githubusercontent.com/u/3953849?v=4" width="100;" alt="gmaciolek"/>
74-
<br />
75-
<sub><b>Gretchen Maciolek</b></sub>
76-
</a>
77-
</td>
78-
<td align="center">
79-
<a href="https://github.com/sb-benohe">
80-
<img src="https://avatars.githubusercontent.com/u/71290292?v=4" width="100;" alt="sb-benohe"/>
81-
<br />
82-
<sub><b>sb-benohe</b></sub>
83-
</a>
84-
</td>
85-
<td align="center">
86-
<a href="https://github.com/oragame">
87-
<img src="https://avatars.githubusercontent.com/u/22204906?v=4" width="100;" alt="oragame"/>
88-
<br />
89-
<sub><b>Don Seymour</b></sub>
90-
</a>
91-
</td>
92-
</tr>
93-
<tr>
94-
<td align="center">
95-
<a href="https://github.com/jimmyfagan">
96-
<img src="https://avatars.githubusercontent.com/u/90421499?v=4" width="100;" alt="jimmyfagan"/>
97-
<br />
98-
<sub><b>jimmyfagan</b></sub>
99-
</a>
100-
</td>
101-
<td align="center">
102-
<a href="https://github.com/stiwarisemanticbits">
103-
<img src="https://avatars.githubusercontent.com/u/57143602?v=4" width="100;" alt="stiwarisemanticbits"/>
104-
<br />
105-
<sub><b>Shivam Tiwari</b></sub>
106-
</a>
107-
</td>
108-
<td align="center">
109-
<a href="https://github.com/clewellyn-nava">
110-
<img src="https://avatars.githubusercontent.com/u/224594471?v=4" width="100;" alt="clewellyn-nava"/>
111-
<br />
112-
<sub><b>Connor Lewellyn</b></sub>
113-
</a>
114-
</td>
115-
<td align="center">
116-
<a href="https://github.com/bwang-icf">
117-
<img src="https://avatars.githubusercontent.com/u/178809349?v=4" width="100;" alt="bwang-icf"/>
118-
<br />
119-
<sub><b>bwang-icf</b></sub>
120-
</a>
121-
</td>
122-
</tr>
123-
<tbody>
124-
</table>
47+
12548
<!-- readme: contributors -end -->
12649

12750
### Alumni

‎CONTRIBUTING.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ contributions.
1111
We encourage you to read this project's CONTRIBUTING policy (you are here), its
1212
[LICENSE](LICENSE.md), and its [README](README.md).
1313

14-
### Workflow and Branhing
14+
### Workflow and Branching
1515

1616
We follow standard GitHub Flow practices:
1717

@@ -78,7 +78,7 @@ We welcome improvements to the project documentation. This includes:
7878
- Developer tutorials
7979
- Code comments and inline documentation
8080

81-
Please file an [issue](https://github.com/CMSGov/ms-bb2-node-sdk/issues) for documentation improvements or submit a pull request with your changes.
81+
Please file an [issue](https://github.com/CMSGov/cms-bb2-python-sdk/issues) for documentation improvements or submit a pull request with your changes.
8282

8383
**Documentation Resources:**
8484
- Developer documentation: https://cmsgov.github.io/bluebutton-developer-help/

‎README.md‎

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -137,27 +137,42 @@ This project follows standard GitHub flow practices:
137137
* Tests should be written for changes introduced
138138
* Each change should be deployable to production
139139

140-
<!-- # Community
140+
# Community
141+
The Blue Button Web Server team is taking a community-first and open source approach to the product development of this tool. We believe government software should be made in the open and be built and licensed such that anyone can download the code, run it themselves without paying money to third parties or using proprietary software, and use it as they will.
141142

142-
# Community Guidelines -->
143+
We know that we can learn from a wide variety of communities, including those who will use or will be impacted by the tool, who are experts in technology, or who have experience with similar technologies deployed in other spaces. We are dedicated to creating forums for continuous conversation and feedback to help shape the design and development of the tool.
144+
145+
We also recognize capacity building as a key part of involving a diverse open source community. We are doing our best to use accessible language, provide technical and process documents, and offer support to community members with a wide variety of backgrounds and skillsets.
146+
147+
# Community Guidelines
148+
Principles and guidelines for participating in our open source community are can be found in [COMMUNITY.md](COMMUNITY.md). Please read them before joining or starting a conversation in this repo or one of the channels listed below. All community members and participants are expected to adhere to the community guidelines and code of conduct when participating in community spaces including: code repositories, communication channels and venues, and events.
143149

144150
# Governance
145151
For more information about our governance, see [GOVERNANCE.md](GOVERNANCE.md).
146152

147153
# Feedback
148154
Got questions? Need help troubleshooting? Want to propose a new feature? Contact the Blue Button 2.0 team and connect with the community in our [Google Group](https://groups.google.com/forum/#!forum/Developer-group-for-cms-blue-button-api).
149155

150-
# Policites
156+
# Policies
157+
### Open Source Policy
151158

152-
# Public Domain
153-
This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the [CC0 1.0 Universal public domain dedication](https://creativecommons.org/publicdomain/zero/1.0/) as indicated in [LICENSE](LICENSE).
159+
We adhere to the [CMS Open Source Policy](https://github.com/CMSGov/cms-open-source-policy). If you have any questions, just [shoot us an email](mailto:opensource@cms.hhs.gov).
154160

155-
All contributions to this project will be released under the CC0 dedication. By submitting a pull request or issue, you are agreeing to comply with this waiver of copyright interest.
161+
### Security and Responsible Disclosure Policy
156162

157-
---------------
158-
163+
_Submit a vulnerability:_ Vulnerability reports can be submitted through [Bugcrowd](https://bugcrowd.com/cms-vdp). Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days.
159164

165+
For more information about our Security, Vulnerability, and Responsible Disclosure Policies, see [SECURITY.md](SECURITY.md).
160166

167+
### Software Bill of Materials (SBOM)
161168

169+
A Software Bill of Materials (SBOM) is a formal record containing the details and supply chain relationships of various components used in building software.
162170

171+
In the spirit of [Executive Order 14028 - Improving the Nation's Cyber Security](https://www.gsa.gov/technology/it-contract-vehicles-and-purchasing-programs/information-technology-category/it-security/executive-order-14028), a SBOM for this repository is provided here: https://github.com/CMSGov/bluebutton-web-server/network/dependencies.
163172

173+
For more information and resources about SBOMs, visit: https://www.cisa.gov/sbom.
174+
175+
# Public Domain
176+
This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the [CC0 1.0 Universal public domain dedication](https://creativecommons.org/publicdomain/zero/1.0/) as indicated in [LICENSE](LICENSE).
177+
178+
All contributions to this project will be released under the CC0 dedication. By submitting a pull request or issue, you are agreeing to comply with this waiver of copyright interest.

‎SECURITY.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Security and Responsible Disclosure Policy
2+
3+
The Centers for Medicare & Medicaid Services is committed to ensuring the security of the American public by protecting their information from unwarranted disclosure. We want security researchers to feel comfortable reporting vulnerabilities they have discovered so we can fix them and keep our users safe. We developed our disclosure policy to reflect our values and uphold our sense of responsibility to security researchers who share their expertise with us in good faith.
4+
5+
*Submit a vulnerability:* Vulnerability reports can be submitted through [Bugcrowd](https://bugcrowd.com/cms-vdp). Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days.
6+
7+
Review the HHS Disclosure Policy and websites in scope:
8+
[https://www.hhs.gov/vulnerability-disclosure-policy/index.html](https://www.hhs.gov/vulnerability-disclosure-policy/index.html).
9+
10+
This policy describes *what systems and types of research* are covered under this
11+
policy, *how to send* us vulnerability reports, and *how long* we ask security
12+
researchers to wait before publicly disclosing vulnerabilities.

‎server/sample-bluebutton-config.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"environment": "SANDBOX",
3-
"client_id": "LHi4TsBoXwwwslUUxYFkNjtuVPvar4rVn10A6xHv",
4-
"client_secret": "devhlKuz9NQXjNIUr5WfE9v4u0b9HzJVqt4XBqtAxdrwlAwru9yYHvRtrhmEAh8Ll57V7aTmr78TI59hz6l2ABwvQfZ2ou5h8g4sGqLuQ7NHvG2dPfSTy4auThnCdX8e",
3+
"client_id": "<client_id>",
4+
"client_secret": "<client_secret>",
55
"callback_url": "http://localhost:3001/api/bluebutton/callback/",
66
"version": 2
77
}

0 commit comments

Comments
 (0)