Weak spots

1Vulnerable libraries

Odoo projects are covered by the module list the Blipit module already sends: a series that no longer gets security fixes, and standard modules still on an older series. For other apps, send the package list with PUT https://in.blipit.io/api/v1/sdk/packages, header X-Blipit-Key with the secret key, body {"packages":[{"ecosystem":"npm","name":"lodash","version":"4.17.15"}]} (ecosystems npm, PyPI, RubyGems, Packagist, Go, NuGet, Maven, Pub, crates.io, Hex, SwiftURL; at most 3,000). Each upload replaces the previous list. Blipit checks every version against the OSV database within minutes and again every day, and shows the advisory, its severity and the version that fixes it.

2Exposure checks

Once a day Blipit checks every domain you monitor in Uptime (HTTP, SSL and domain monitors, up to 20 per workspace): TLS certificate expiry (warning under 14 days) and whether TLS 1.0 or 1.1 is still accepted, a grade for six security headers (HSTS, Content-Security-Policy, frame protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), whether /.env, /.git/HEAD, /.DS_Store, /server-status, /phpinfo.php or /wp-config.php.bak can be downloaded (a 200 whose content matches the file, not just any page), secret API keys in the homepage's own JavaScript bundles, and SPF and DMARC on the main domain. Requests use GET, short timeouts and a pause between them, identify as Blipit-SecurityCheck, never follow a redirect to another host and never reach private addresses.

3Score and fix first

Each project starts at 100. Open vulnerabilities take off 25 (critical), 15 (high), 5 (medium or unrated) or 2 (low), up to 60 in total. Failed checks take off up to 30 each (a public .env, .git or config backup, or a leaked key) and warnings less. Open security alerts of the last 7 days take off 3 each, up to 15. Fix first lists the five items that cost the most. A domain counts for a project when it is the host of its Odoo instance, or when the workspace has one project.

4Alerts and the weekly email

A new high or critical vulnerability, a newly exposed file or a leaked key raises a security alert through your alert channels, once. Workspace owners can also get a weekly security email with the score and the fix-first list; turn it off in Settings.

Good to know

• Why only monitored domains: adding a domain to Uptime is how a workspace shows it is theirs. Blipit never checks a domain nobody in the workspace monitors.
• Leaked keys are shown masked; Blipit never stores the full key.
• OSV does not list Odoo core advisories, so Odoo core is judged by its support status.