From 1bcd8ca886e97f7b08ae6ce361922951f516c247 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Fri, 30 Dec 2022 21:33:10 +0900
Subject: [PATCH 01/31] [skip netlify] owaspzap

---
 .dockerignore                  |  1 +
 .github/workflows/owaspzap.yml | 20 ++++-------------
 owasp/Dockerfile               |  8 +++++++
 owasp/docker-compose-ci.yml    | 40 +++++++++++++++++++++++++++++++++
 owasp/docker-compose.yml       | 41 ++++++++++++++++++++++++++++++++++
 5 files changed, 94 insertions(+), 16 deletions(-)
 create mode 100644 .dockerignore
 create mode 100644 owasp/Dockerfile
 create mode 100644 owasp/docker-compose-ci.yml
 create mode 100644 owasp/docker-compose.yml

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000000..3c3629e647
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1 @@
+node_modules
diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index 7d9bf70109..b8bd97e689 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -1,10 +1,7 @@
 name: OWASP ZAP Actions
 on:
   workflow_dispatch:
-    inputs:
-      target_website:
-        default: "https://blog.tubone-project24.xyz"
-        type: string
+  push:
 jobs:
   website-scan:
     runs-on: ubuntu-latest
@@ -13,15 +10,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v2
       - name: Action Full Scan
-        uses: zaproxy/action-full-scan@v0.4.0
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          docker_name: owasp/zap2docker-stable
-          target: ${{ inputs.target_website }}
-          cmd_options: >
-            -a
-            -j
-            -z "
-            -config alert.maxInstances=0
-            -config view.locale=ja_JP
-            "
+        run: |
+          docker-compose -f owasp/docker-compose-ci.yml up -d
+          docker-compose -f owasp/docker-compose-ci.yml exec owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
diff --git a/owasp/Dockerfile b/owasp/Dockerfile
new file mode 100644
index 0000000000..78144c2b72
--- /dev/null
+++ b/owasp/Dockerfile
@@ -0,0 +1,8 @@
+FROM node:16.17.0-buster-slim
+
+ENV NODE_ENV production
+WORKDIR /app
+COPY ["package.json", "./"]
+COPY ["public", "public"]
+RUN npm install -g serve
+CMD ["serve", "-s", "-l", "9000", "public"]
\ No newline at end of file
diff --git a/owasp/docker-compose-ci.yml b/owasp/docker-compose-ci.yml
new file mode 100644
index 0000000000..bb94bd18fe
--- /dev/null
+++ b/owasp/docker-compose-ci.yml
@@ -0,0 +1,40 @@
+version: '3'
+
+services:
+  web:
+    container_name: web-target
+    build:
+      context: ../
+      dockerfile: owasp/Dockerfile
+    command:
+      - "npx"
+      - "serve"
+      - "-s"
+      - "-l"
+      - "9000"
+      - "public"
+    ports:
+      - "9000:9000" # yarn serve
+      - "8000:8000" # yarn dev
+    networks:
+      - myNW
+    tty: true
+
+  owasp:
+    container_name: owasp
+    image: owasp/zap2docker-stable
+    volumes:
+      - ./zap:/zap/wrk/
+    ports:
+      - "18081:8080"
+      - "18090:8090"
+    depends_on:
+      - web
+    networks:
+      - myNW
+      - default
+    tty: true
+
+networks:
+  myNW:
+    internal: true
diff --git a/owasp/docker-compose.yml b/owasp/docker-compose.yml
new file mode 100644
index 0000000000..c4239ac636
--- /dev/null
+++ b/owasp/docker-compose.yml
@@ -0,0 +1,41 @@
+version: '3'
+
+services:
+  web:
+    container_name: web-target
+    build:
+      context: ../
+      dockerfile: owasp/Dockerfile
+    command:
+      - "npx"
+      - "serve"
+      - "-s"
+      - "-l"
+      - "9000"
+      - "public"
+    ports:
+      - "9000:9000" # yarn serve
+      - "8000:8000" # yarn dev
+    networks:
+      - myNW
+    tty: true
+
+  owasp:
+    container_name: owasp-web-ui
+    image: owasp/zap2docker-stable
+    command: bash -c "zap.sh -cmd -addonuninstall hud && zap-webswing.sh"
+    volumes:
+      - ./zap:/zap/wrk/
+    ports:
+      - "18081:8080"
+      - "18090:8090"
+    depends_on:
+      - web
+    networks:
+      - myNW
+      - default
+    tty: true
+
+networks:
+  myNW:
+    internal: true

From f75b6a205e25c9ba865cfd35a68d86a8ee6f347a Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Fri, 30 Dec 2022 21:36:11 +0900
Subject: [PATCH 02/31] [skip netlify] owaspzap

---
 .github/workflows/owaspzap.yml | 52 ++++++++++++++++++++++++++++++++--
 1 file changed, 50 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index b8bd97e689..9545b8d1d9 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -7,8 +7,56 @@ jobs:
     runs-on: ubuntu-latest
     name: DAST (Dynamic Application Security Testing)
     steps:
-      - name: Checkout
-        uses: actions/checkout@v2
+      - name: Checkout source code
+        uses: actions/checkout@v3
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+          registry-url: https://npm.pkg.github.com/
+          scope: '@tubone24'
+      - name: Get yarn cache directory path
+        id: yarn-cache-dir-path
+        run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
+      - name: Cache
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cache
+            ${{ steps.yarn-cache-dir-path.outputs.dir }}
+            node_modules
+            .cache
+            public
+          key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
+            ${{ runner.os }}-build-
+            ${{ runner.os }}-
+      - name: yarn install
+        env:
+          GATSBY_GITHUB_CLIENT_SECRET: ${{secrets.GATSBY_GITHUB_CLIENT_SECRET}}
+          GATSBY_GITHUB_CLIENT_ID: ${{secrets.GATSBY_GITHUB_CLIENT_ID}}
+          GATSBY_ALGOLIA_SEARCH_API_KEY: ${{secrets.GATSBY_ALGOLIA_SEARCH_API_KEY}}
+          GATSBY_ALGOLIA_INDEX_NAME: ${{secrets.GATSBY_ALGOLIA_INDEX_NAME}}
+          GATSBY_ALGOLIA_APP_ID: ${{secrets.GATSBY_ALGOLIA_APP_ID}}
+          GATSBY_ALGOLIA_ADMIN_API_KEY: ${{secrets.GATSBY_ALGOLIA_ADMIN_API_KEY}}
+          GATSBY_GITHUB_SHA: ${{ github.sha }}
+          FAUNADB_SERVER_SECRET: ${{secrets.FAUNADB_SERVER_SECRET}}
+          NETLIFY_ENV: deploy-preview
+          NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+        run: yarn install --frozen-lockfile
+      - name: yarn build
+        env:
+          GATSBY_GITHUB_CLIENT_SECRET: ${{secrets.GATSBY_GITHUB_CLIENT_SECRET}}
+          GATSBY_GITHUB_CLIENT_ID: ${{secrets.GATSBY_GITHUB_CLIENT_ID}}
+          GATSBY_ALGOLIA_SEARCH_API_KEY: ${{secrets.GATSBY_ALGOLIA_SEARCH_API_KEY}}
+          GATSBY_ALGOLIA_INDEX_NAME: ${{secrets.GATSBY_ALGOLIA_INDEX_NAME}}
+          GATSBY_ALGOLIA_APP_ID: ${{secrets.GATSBY_ALGOLIA_APP_ID}}
+          GATSBY_ALGOLIA_ADMIN_API_KEY: ${{secrets.GATSBY_ALGOLIA_ADMIN_API_KEY}}
+          GATSBY_GITHUB_SHA: ${{ github.sha }}
+          FAUNADB_SERVER_SECRET: ${{secrets.FAUNADB_SERVER_SECRET}}
+          NETLIFY_ENV: deploy-preview
+        run: yarn build
       - name: Action Full Scan
         run: |
           docker-compose -f owasp/docker-compose-ci.yml up -d

From adcceaf52e9d97eb9a691ee2873233c7768869b0 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Fri, 30 Dec 2022 21:42:38 +0900
Subject: [PATCH 03/31] [skip netlify] not tty

---
 owasp/docker-compose-ci.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/owasp/docker-compose-ci.yml b/owasp/docker-compose-ci.yml
index bb94bd18fe..b81996793e 100644
--- a/owasp/docker-compose-ci.yml
+++ b/owasp/docker-compose-ci.yml
@@ -18,7 +18,6 @@ services:
       - "8000:8000" # yarn dev
     networks:
       - myNW
-    tty: true
 
   owasp:
     container_name: owasp
@@ -33,7 +32,6 @@ services:
     networks:
       - myNW
       - default
-    tty: true
 
 networks:
   myNW:

From 41d72031c2488cbdd96b5fca488694d058ff7fd6 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Fri, 30 Dec 2022 21:54:12 +0900
Subject: [PATCH 04/31] [skip netlify] not tty

---
 owasp/docker-compose-ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/owasp/docker-compose-ci.yml b/owasp/docker-compose-ci.yml
index b81996793e..583b200eb8 100644
--- a/owasp/docker-compose-ci.yml
+++ b/owasp/docker-compose-ci.yml
@@ -22,6 +22,7 @@ services:
   owasp:
     container_name: owasp
     image: owasp/zap2docker-stable
+    command: bash -c "zap.sh -cmd -addonuninstall hud && zap-webswing.sh"
     volumes:
       - ./zap:/zap/wrk/
     ports:

From ff30a138fa7073b0ac2eb02b9faa9ad8bd50b985 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Fri, 30 Dec 2022 22:00:24 +0900
Subject: [PATCH 05/31] [skip netlify] not tty

---
 owasp/docker-compose-ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/owasp/docker-compose-ci.yml b/owasp/docker-compose-ci.yml
index 583b200eb8..40cc16b52b 100644
--- a/owasp/docker-compose-ci.yml
+++ b/owasp/docker-compose-ci.yml
@@ -33,6 +33,7 @@ services:
     networks:
       - myNW
       - default
+    tty: true
 
 networks:
   myNW:

From 6cce14f98536a38339dd58d08362a1b1dbae1545 Mon Sep 17 00:00:00 2001
From: "tubone(Yu Otsubo)" <tubo.yyyuuu@gmail.com>
Date: Fri, 30 Dec 2022 22:11:43 +0900
Subject: [PATCH 06/31] Update docker-compose-ci.yml

---
 owasp/docker-compose-ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/owasp/docker-compose-ci.yml b/owasp/docker-compose-ci.yml
index 40cc16b52b..583b200eb8 100644
--- a/owasp/docker-compose-ci.yml
+++ b/owasp/docker-compose-ci.yml
@@ -33,7 +33,6 @@ services:
     networks:
       - myNW
       - default
-    tty: true
 
 networks:
   myNW:

From 7f72678be35ccbb2b415fdb3973ce643de38fce2 Mon Sep 17 00:00:00 2001
From: "tubone(Yu Otsubo)" <tubo.yyyuuu@gmail.com>
Date: Fri, 30 Dec 2022 22:12:27 +0900
Subject: [PATCH 07/31] Update owaspzap.yml

---
 .github/workflows/owaspzap.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index 9545b8d1d9..5d6bb5a19f 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -60,4 +60,4 @@ jobs:
       - name: Action Full Scan
         run: |
           docker-compose -f owasp/docker-compose-ci.yml up -d
-          docker-compose -f owasp/docker-compose-ci.yml exec owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
+          docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -z "-config alert.maxInstances=0 -config view.locale=ja_JP"

From 34f9c3a8893e1416399842dc30c2488303b03fff Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Fri, 30 Dec 2022 23:54:08 +0900
Subject: [PATCH 08/31] gitkeep

---
 owasp/zap/.gitkeep | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 owasp/zap/.gitkeep

diff --git a/owasp/zap/.gitkeep b/owasp/zap/.gitkeep
new file mode 100644
index 0000000000..e69de29bb2

From 212eee3d36ad12fcfc8edbb7ab5ac5b17a180c31 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 10:18:42 +0900
Subject: [PATCH 09/31] [skip netlify] not tty

---
 .github/workflows/owaspzap.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index 5d6bb5a19f..a42e1f24d6 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -59,5 +59,6 @@ jobs:
         run: yarn build
       - name: Action Full Scan
         run: |
+          chmod 777 zap
           docker-compose -f owasp/docker-compose-ci.yml up -d
           docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -z "-config alert.maxInstances=0 -config view.locale=ja_JP"

From 64ad96634a3ca3a469d23205642a1ceb2d4001ac Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 10:26:31 +0900
Subject: [PATCH 10/31] [skip netlify] not tty

---
 .github/workflows/owaspzap.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index a42e1f24d6..36a985a32c 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -59,6 +59,11 @@ jobs:
         run: yarn build
       - name: Action Full Scan
         run: |
-          chmod 777 zap
+          chmod 777 owasp/zap
           docker-compose -f owasp/docker-compose-ci.yml up -d
           docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
+      - name: push report
+        uses: actions/upload-artifact@v3
+        with:
+          name: owasp-report
+          path: owasp/zap/report.html

From f61b0e6262e27af1ca5735468628e50ac593a5e8 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 10:52:15 +0900
Subject: [PATCH 11/31] [skip netlify] not tty

---
 .github/workflows/owaspzap.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index 36a985a32c..65c30d7b01 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -62,6 +62,14 @@ jobs:
           chmod 777 owasp/zap
           docker-compose -f owasp/docker-compose-ci.yml up -d
           docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
+      - name: Capture Webpage Screenshot
+        uses: saadmk11/comment-website-screenshot@v0.5
+        with:
+          upload_to: github_branch
+          capture_changed_html_files: yes
+          # Comma separated paths to any other HTML File
+          capture_html_file_paths: "owasp/zap/report.html"
+
       - name: push report
         uses: actions/upload-artifact@v3
         with:

From 7bf326dc2d88a62d409ca34ea613539c21af87fc Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 11:40:02 +0900
Subject: [PATCH 12/31] [skip netlify] not tty

---
 .github/workflows/owaspzap.yml      | 3 ++-
 .github/workflows/previewDeploy.yml | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index 65c30d7b01..d28e07fcc3 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -63,14 +63,15 @@ jobs:
           docker-compose -f owasp/docker-compose-ci.yml up -d
           docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
       - name: Capture Webpage Screenshot
+        if: always()
         uses: saadmk11/comment-website-screenshot@v0.5
         with:
           upload_to: github_branch
           capture_changed_html_files: yes
-          # Comma separated paths to any other HTML File
           capture_html_file_paths: "owasp/zap/report.html"
 
       - name: push report
+        if: always()
         uses: actions/upload-artifact@v3
         with:
           name: owasp-report
diff --git a/.github/workflows/previewDeploy.yml b/.github/workflows/previewDeploy.yml
index 110137267d..24055682d2 100644
--- a/.github/workflows/previewDeploy.yml
+++ b/.github/workflows/previewDeploy.yml
@@ -461,7 +461,7 @@ jobs:
       - name: Checkout source code
         uses: actions/checkout@v3
       - name: "depcheck"
-        uses: tubone24/depcheck_action@v1.1.0
+        uses: tubone24/depcheck_action@main
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_COMMENT_URL: ${{ github.event.pull_request.comments_url }}

From 0a280d11803b1a37597141dd214e0239fa0f8790 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 11:59:06 +0900
Subject: [PATCH 13/31] [skip netlify] snyk

---
 .github/workflows/previewDeploy.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/previewDeploy.yml b/.github/workflows/previewDeploy.yml
index 24055682d2..80cbf9008f 100644
--- a/.github/workflows/previewDeploy.yml
+++ b/.github/workflows/previewDeploy.yml
@@ -432,17 +432,28 @@ jobs:
           echo '# Snyk vulnerability report' >> summarize.txt
           echo '## OSS packages' >> summarize.txt
           echo '' >> summarize.txt
+          echo '' >> summarize.txt
+          echo '<details>' >> summarize.txt
           cat snyk.txt | sed -z 's/\n/\\n/g' >> summarize.txt
+          echo '</details>' >> summarize.txt
           echo '' >> summarize.txt
           echo '' >> summarize.txt
           echo '## Application' >> summarize.txt
           echo '' >> summarize.txt
+          echo '' >> summarize.txt
+          echo '<details>' >> summarize.txt
           cat snyk_code.txt | sed -z 's/\n/\\n/g' >> summarize.txt
+          echo '</details>' >> summarize.txt
           echo '' >> summarize.txt
           echo '' >> summarize.txt
           echo '## IaC' >> summarize.txt
           echo '' >> summarize.txt
+          echo '' >> summarize.txt
+          echo '<details>' >> summarize.txt
+          echo '' >> summarize.txt
           cat snyk_iac.txt | sed -z 's/\n/\\n/g' >> summarize.txt
+          echo '' >> summarize.txt
+          echo '</details>' >> summarize.txt
           sed -i -z 's/\n/\\n/g' summarize.txt
           sed -i 's/Testing \.\.\.\.//g' summarize.txt
           sed -i 's/Testing \. \.\.\.//g' summarize.txt
@@ -461,7 +472,7 @@ jobs:
       - name: Checkout source code
         uses: actions/checkout@v3
       - name: "depcheck"
-        uses: tubone24/depcheck_action@main
+        uses: tubone24/depcheck_action@v1.2.0
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_COMMENT_URL: ${{ github.event.pull_request.comments_url }}

From 0bf35c0bcc4ea905f1fd000379b393326d63546e Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 12:09:29 +0900
Subject: [PATCH 14/31] [skip netlify] snyk

---
 .github/workflows/previewDeploy.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/previewDeploy.yml b/.github/workflows/previewDeploy.yml
index 80cbf9008f..0ebe3ab91a 100644
--- a/.github/workflows/previewDeploy.yml
+++ b/.github/workflows/previewDeploy.yml
@@ -360,10 +360,10 @@ jobs:
       - name: summarize
         run: |
           cat test/memlab/data/out/leaks.txt
-          sed -i '1s/^/## Memlab leaks report\\n\`\`\`\\n/g' test/memlab/data/out/leaks.txt
+          sed -i '1s/^/## Memlab leaks report\\n\`\`\`\\n\<details\>\\n/g' test/memlab/data/out/leaks.txt
           sed -i -z 's/\n/\\n/g' test/memlab/data/out/leaks.txt
           sed -i -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})*)?m//g" test/memlab/data/out/leaks.txt
-          echo -n "\\n \`\`\` \\n " >> test/memlab/data/out/leaks.txt
+          echo -n "\\n \`\`\` \\n</details>\\n " >> test/memlab/data/out/leaks.txt
       - name: Post Memlab Report Comment
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 167f06066c03a1dd540143aac0151515dc22576e Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 13:23:19 +0900
Subject: [PATCH 15/31] [skip netlify] snyk

---
 .github/workflows/previewDeploy.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/previewDeploy.yml b/.github/workflows/previewDeploy.yml
index 0ebe3ab91a..8e90085511 100644
--- a/.github/workflows/previewDeploy.yml
+++ b/.github/workflows/previewDeploy.yml
@@ -360,7 +360,7 @@ jobs:
       - name: summarize
         run: |
           cat test/memlab/data/out/leaks.txt
-          sed -i '1s/^/## Memlab leaks report\\n\`\`\`\\n\<details\>\\n/g' test/memlab/data/out/leaks.txt
+          sed -i '1s/^/## Memlab leaks report\\n\<details\>\\n\\n\`\`\`\\n/g' test/memlab/data/out/leaks.txt
           sed -i -z 's/\n/\\n/g' test/memlab/data/out/leaks.txt
           sed -i -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})*)?m//g" test/memlab/data/out/leaks.txt
           echo -n "\\n \`\`\` \\n</details>\\n " >> test/memlab/data/out/leaks.txt

From 1edf994b96353b84c73194ffffc9c0cfad80eed5 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 13:41:05 +0900
Subject: [PATCH 16/31] [skip netlify] snyk

---
 .github/workflows/deploy.yml        |  6 ------
 .github/workflows/owaspzap.yml      |  4 +---
 .github/workflows/previewDeploy.yml | 16 ----------------
 3 files changed, 1 insertion(+), 25 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a315066c41..3fb2af0003 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -28,8 +28,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
@@ -161,8 +159,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
@@ -224,8 +220,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index d28e07fcc3..429396fe92 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -25,8 +25,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
@@ -61,7 +59,7 @@ jobs:
         run: |
           chmod 777 owasp/zap
           docker-compose -f owasp/docker-compose-ci.yml up -d
-          docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
+          docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -I -m 1 -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
       - name: Capture Webpage Screenshot
         if: always()
         uses: saadmk11/comment-website-screenshot@v0.5
diff --git a/.github/workflows/previewDeploy.yml b/.github/workflows/previewDeploy.yml
index 8e90085511..ba63724548 100644
--- a/.github/workflows/previewDeploy.yml
+++ b/.github/workflows/previewDeploy.yml
@@ -42,8 +42,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
@@ -126,8 +124,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
@@ -175,8 +171,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
@@ -262,8 +256,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
@@ -330,8 +322,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
@@ -394,8 +384,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
@@ -496,8 +484,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
@@ -530,8 +516,6 @@ jobs:
             ~/.cache
             ${{ steps.yarn-cache-dir-path.outputs.dir }}
             node_modules
-            .cache
-            public
           key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}

From 51bd6011a360ce29f9b69c160c1be84610163c02 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 14:13:13 +0900
Subject: [PATCH 17/31] [skip netlify] deploy report

---
 .github/workflows/owaspzap.yml | 9 ++++++++-
 owasp/docker-compose-ci.yml    | 1 -
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index 429396fe92..cf62378623 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -67,7 +67,14 @@ jobs:
           upload_to: github_branch
           capture_changed_html_files: yes
           capture_html_file_paths: "owasp/zap/report.html"
-
+      - name: Deploy Report
+        uses: peaceiris/actions-gh-pages@v3
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./public
+          destination_dir: owasp
+          keep_files: true
+          exclude_assets: '*.cer,*.key'
       - name: push report
         if: always()
         uses: actions/upload-artifact@v3
diff --git a/owasp/docker-compose-ci.yml b/owasp/docker-compose-ci.yml
index 583b200eb8..dcf2f1cbdc 100644
--- a/owasp/docker-compose-ci.yml
+++ b/owasp/docker-compose-ci.yml
@@ -32,7 +32,6 @@ services:
       - web
     networks:
       - myNW
-      - default
 
 networks:
   myNW:

From 16c1b785f66e5fab10a597ef2d23e14015e7da03 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 14:34:53 +0900
Subject: [PATCH 18/31] [skip netlify] deploy report

---
 .github/workflows/owaspzap.yml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index cf62378623..978f669fa7 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -60,13 +60,6 @@ jobs:
           chmod 777 owasp/zap
           docker-compose -f owasp/docker-compose-ci.yml up -d
           docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -I -m 1 -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
-      - name: Capture Webpage Screenshot
-        if: always()
-        uses: saadmk11/comment-website-screenshot@v0.5
-        with:
-          upload_to: github_branch
-          capture_changed_html_files: yes
-          capture_html_file_paths: "owasp/zap/report.html"
       - name: Deploy Report
         uses: peaceiris/actions-gh-pages@v3
         with:

From e1258315883dd4355ebcde8ab7f0b2128feb75a8 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 14:54:54 +0900
Subject: [PATCH 19/31] Add CSP

---
 src/html.tsx    | 5 ++++-
 static/_headers | 2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 static/_headers

diff --git a/src/html.tsx b/src/html.tsx
index 4002dc3826..06b433b273 100644
--- a/src/html.tsx
+++ b/src/html.tsx
@@ -32,7 +32,10 @@ const HTML = ({
     <body {...bodyAttributes}>
       {preBodyComponents}
       <script src="/adstir.js" />
-      <script src="https://js.ad-stir.com/js/adstir.js" />
+      <script
+        src="https://js.ad-stir.com/js/adstir.js"
+        nonce="ZsQmvvc24RF0Q3OGhq"
+      />
       <div
         key="body"
         id="___gatsby"
diff --git a/static/_headers b/static/_headers
new file mode 100644
index 0000000000..567971fc42
--- /dev/null
+++ b/static/_headers
@@ -0,0 +1,2 @@
+/*
+  Content-Security-Policy: default-src 'self'; img-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq', 'https://www.google-analytics.com', 'https://ssl.google-analytics.com', 'https://platform.twitter.com', 'https://www.instagram.com', 'https://embedr.flickr.com', 'https://embed.redditmedia.com'
\ No newline at end of file

From 24746199ecb2acda6166a509cd4818c58017faa2 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 14:55:45 +0900
Subject: [PATCH 20/31] Add CSP

---
 .gitignore | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitignore b/.gitignore
index 0532335d8d..42d57cdf99 100644
--- a/.gitignore
+++ b/.gitignore
@@ -41,3 +41,7 @@ test/memlab/data
 
 # synk
 .dccache
+
+# OWASPZAP
+owasp/zap/*.key
+owasp/zap/*.cer
\ No newline at end of file

From d8f4b24038bcec06f465ea73e9c05b8bcb63d16b Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 15:04:49 +0900
Subject: [PATCH 21/31] webscreenshot

---
 .github/workflows/owaspzap.yml      |  2 ++
 .github/workflows/previewDeploy.yml | 14 ++++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index 978f669fa7..9843649032 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -2,6 +2,8 @@ name: OWASP ZAP Actions
 on:
   workflow_dispatch:
   push:
+env:
+  cache-version: v1
 jobs:
   website-scan:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/previewDeploy.yml b/.github/workflows/previewDeploy.yml
index ba63724548..fed61bf5b4 100644
--- a/.github/workflows/previewDeploy.yml
+++ b/.github/workflows/previewDeploy.yml
@@ -572,3 +572,17 @@ jobs:
                -d "{\"body\": \"$(cat cli.txt)\"}" \
                ${URL}
 
+
+  webscreenshot:
+    runs-on: ubuntu-latest
+    needs:
+      - build
+      - check-skip-flags
+    steps:
+      - name: Capture Webpage Screenshot
+        if: ${{ !contains(needs.check-skip-flags.outputs.head-commit-message, '[skip netlify]') }}
+        uses: saadmk11/comment-website-screenshot@v0.5
+        with:
+          upload_to: github_branch
+          capture_changed_html_files: yes
+          capture_urls: ${{ needs.build.outputs.draftUrl }}

From cc30d288cc68de849e0827c8a8e9ef67538f7b38 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 15:16:46 +0900
Subject: [PATCH 22/31] meta csp

---
 src/html.tsx    | 4 ++++
 static/_headers | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/html.tsx b/src/html.tsx
index 06b433b273..2525e7d118 100644
--- a/src/html.tsx
+++ b/src/html.tsx
@@ -24,6 +24,10 @@ const HTML = ({
         name="viewport"
         content="width=device-width, initial-scale=1, shrink-to-fit=no"
       />
+      <meta
+        httpEquiv="Content-Security-Policy"
+        content="default-src 'self'; img-src *; media-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq' 'https://www.google-analytics.com' 'https://ssl.google-analytics.com' 'https://platform.twitter.com' 'https://www.instagram.com' 'https://embedr.flickr.com' 'https://embed.redditmedia.com';"
+      />
       <meta name="p:domain_verify" content="2accdaac3153e1b438ab307ac5c4b855" />
       <link rel="prefetch" href="/fonts/icomoon.woff2?s0mo8f" />
       <link rel="preconnect dns-prefetch" href="//i.imgur.com" />
diff --git a/static/_headers b/static/_headers
index 567971fc42..d76c239af3 100644
--- a/static/_headers
+++ b/static/_headers
@@ -1,2 +1,2 @@
 /*
-  Content-Security-Policy: default-src 'self'; img-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq', 'https://www.google-analytics.com', 'https://ssl.google-analytics.com', 'https://platform.twitter.com', 'https://www.instagram.com', 'https://embedr.flickr.com', 'https://embed.redditmedia.com'
\ No newline at end of file
+  Content-Security-Policy: default-src 'self'; img-src *; media-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq', 'https://www.google-analytics.com', 'https://ssl.google-analytics.com', 'https://platform.twitter.com', 'https://www.instagram.com', 'https://embedr.flickr.com', 'https://embed.redditmedia.com';
\ No newline at end of file

From 86bfb200617902cf66e049c9fe5e18cce4a0423d Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 15:26:02 +0900
Subject: [PATCH 23/31] meta csp

---
 src/html.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/html.tsx b/src/html.tsx
index 2525e7d118..c1abf266cc 100644
--- a/src/html.tsx
+++ b/src/html.tsx
@@ -26,7 +26,7 @@ const HTML = ({
       />
       <meta
         httpEquiv="Content-Security-Policy"
-        content="default-src 'self'; img-src *; media-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq' 'https://www.google-analytics.com' 'https://ssl.google-analytics.com' 'https://platform.twitter.com' 'https://www.instagram.com' 'https://embedr.flickr.com' 'https://embed.redditmedia.com';"
+        content="default-src 'self'; img-src *; media-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq' 'https://www.google-analytics.com' 'https://ssl.google-analytics.com' 'https://platform.twitter.com' 'https://www.instagram.com' 'https://embedr.flickr.com' 'https://embed.redditmedia.com' 'https://ad.ad-stir.com';"
       />
       <meta name="p:domain_verify" content="2accdaac3153e1b438ab307ac5c4b855" />
       <link rel="prefetch" href="/fonts/icomoon.woff2?s0mo8f" />

From 3df01f777cfb0cb8a552f6da2b3c13c7555c6601 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 15:28:57 +0900
Subject: [PATCH 24/31] meta csp

---
 static/_headers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/static/_headers b/static/_headers
index d76c239af3..2d2dfe406e 100644
--- a/static/_headers
+++ b/static/_headers
@@ -1,2 +1,2 @@
 /*
-  Content-Security-Policy: default-src 'self'; img-src *; media-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq', 'https://www.google-analytics.com', 'https://ssl.google-analytics.com', 'https://platform.twitter.com', 'https://www.instagram.com', 'https://embedr.flickr.com', 'https://embed.redditmedia.com';
\ No newline at end of file
+  Content-Security-Policy: default-src 'self'; img-src *; media-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq' 'https://www.google-analytics.com' 'https://ssl.google-analytics.com' 'https://platform.twitter.com' 'https://www.instagram.com' 'https://embedr.flickr.com' 'https://embed.redditmedia.com' 'https://ad.ad-stir.com';
\ No newline at end of file

From 97adde3aaf136d3d169dec43218418505641af02 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 15:32:31 +0900
Subject: [PATCH 25/31] meta csp

---
 static/_headers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/static/_headers b/static/_headers
index 2d2dfe406e..2492b977e9 100644
--- a/static/_headers
+++ b/static/_headers
@@ -1,2 +1,2 @@
 /*
-  Content-Security-Policy: default-src 'self'; img-src *; media-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq' 'https://www.google-analytics.com' 'https://ssl.google-analytics.com' 'https://platform.twitter.com' 'https://www.instagram.com' 'https://embedr.flickr.com' 'https://embed.redditmedia.com' 'https://ad.ad-stir.com';
\ No newline at end of file
+  Content-Security-Policy: default-src 'self'; img-src *; media-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq' 'https://www.google-analytics.com' 'https://ssl.google-analytics.com' 'https://platform.twitter.com' 'https://www.instagram.com' 'https://embedr.flickr.com' 'https://embed.redditmedia.com' 'https://ad.ad-stir.com'; frame-ancestors: 'self' 'https://www.google-analytics.com' 'https://ssl.google-analytics.com' 'https://platform.twitter.com' 'https://www.instagram.com' 'https://embedr.flickr.com' 'https://embed.redditmedia.com' 'https://ad.ad-stir.com';
\ No newline at end of file

From ac121fe652f890b5494b1c32d1afd77f883d6c10 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 16:00:03 +0900
Subject: [PATCH 26/31] meta csp

---
 static/_headers | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/static/_headers b/static/_headers
index 2492b977e9..b03e4a5ca3 100644
--- a/static/_headers
+++ b/static/_headers
@@ -1,2 +1,3 @@
 /*
-  Content-Security-Policy: default-src 'self'; img-src *; media-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq' 'https://www.google-analytics.com' 'https://ssl.google-analytics.com' 'https://platform.twitter.com' 'https://www.instagram.com' 'https://embedr.flickr.com' 'https://embed.redditmedia.com' 'https://ad.ad-stir.com'; frame-ancestors: 'self' 'https://www.google-analytics.com' 'https://ssl.google-analytics.com' 'https://platform.twitter.com' 'https://www.instagram.com' 'https://embedr.flickr.com' 'https://embed.redditmedia.com' 'https://ad.ad-stir.com';
\ No newline at end of file
+  Content-Security-Policy: default-src 'self'; img-src *; media-src *; script-src 'self' 'nonce-ZsQmvvc24RF0Q3OGhq' 'https://www.google-analytics.com' 'https://ssl.google-analytics.com' 'https://platform.twitter.com' 'https://www.instagram.com' 'https://embedr.flickr.com' 'https://embed.redditmedia.com' 'https://ad.ad-stir.com'; frame-ancestors: 'self' 'https://www.google-analytics.com' 'https://ssl.google-analytics.com' 'https://platform.twitter.com' 'https://www.instagram.com' 'https://embedr.flickr.com' 'https://embed.redditmedia.com' 'https://ad.ad-stir.com';
+  X-Content-Type-Options: nosniff;
\ No newline at end of file

From 897b75fb5b4600e41188444925db1bb396351f0f Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 16:02:48 +0900
Subject: [PATCH 27/31] meta csp

---
 static/_redirects | 1 +
 1 file changed, 1 insertion(+)

diff --git a/static/_redirects b/static/_redirects
index 7a47f46d0f..0bc95104c5 100644
--- a/static/_redirects
+++ b/static/_redirects
@@ -3,3 +3,4 @@
 /index.xml/ /rss.xml 301
 /sitemap/ /sitemap-index.xml 301
 /sitemap.xml /sitemap-index.xml 301
+/latest/meta-data/ / 301

From 470bb6383edb2ef4ab4cd217ca4b95cc82af215f Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 16:04:41 +0900
Subject: [PATCH 28/31] meta csp

---
 .github/workflows/owaspzap.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index 9843649032..c62faf0fff 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -62,6 +62,8 @@ jobs:
           chmod 777 owasp/zap
           docker-compose -f owasp/docker-compose-ci.yml up -d
           docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -I -m 1 -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
+      - name: cp report.html
+        run: mkdir public && cp report.html public
       - name: Deploy Report
         uses: peaceiris/actions-gh-pages@v3
         with:

From 73f724ca29d2ee93d19f23d0931d2c8af31b3999 Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 16:14:35 +0900
Subject: [PATCH 29/31] meta csp

---
 .github/workflows/previewDeploy.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/previewDeploy.yml b/.github/workflows/previewDeploy.yml
index fed61bf5b4..1ccc0d2c87 100644
--- a/.github/workflows/previewDeploy.yml
+++ b/.github/workflows/previewDeploy.yml
@@ -579,6 +579,7 @@ jobs:
       - build
       - check-skip-flags
     steps:
+      - uses: actions/checkout@v3
       - name: Capture Webpage Screenshot
         if: ${{ !contains(needs.check-skip-flags.outputs.head-commit-message, '[skip netlify]') }}
         uses: saadmk11/comment-website-screenshot@v0.5

From 216109707274666ca188c63beb4199028fdb5aef Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 17:01:35 +0900
Subject: [PATCH 30/31] meta csp

---
 .github/workflows/owaspzap.yml |  4 +---
 README.md                      | 28 ++++++++++++++++++++++------
 2 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index c62faf0fff..d882ad3e19 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -62,13 +62,11 @@ jobs:
           chmod 777 owasp/zap
           docker-compose -f owasp/docker-compose-ci.yml up -d
           docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -I -m 1 -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
-      - name: cp report.html
-        run: mkdir public && cp report.html public
       - name: Deploy Report
         uses: peaceiris/actions-gh-pages@v3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./public
+          publish_dir: ./owasp/zap/
           destination_dir: owasp
           keep_files: true
           exclude_assets: '*.cer,*.key'
diff --git a/README.md b/README.md
index a415dc025b..8f72b46823 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,7 @@
 [![storybook](https://raw.githubusercontent.com/storybookjs/brand/master/badge/badge-storybook.svg)](https://blog-storybook.netlify.app/)
 [![time tracker](https://wakatime.com/badge/github/tubone24/blog.svg)](https://wakatime.com/badge/github/tubone24/blog)
 <a href="https://validator.w3.org/feed/check.cgi?url=https%3A//blog.tubone-project24.xyz/rss.xml"><img src="https://validator.w3.org/feed/images/valid-rss-rogers.png" alt="[Valid RSS]" title="Validate my RSS feed" /></a>
+![blog Actions](https://api.meercode.io/badge/tubone24/blog?type=ci-score&lastDay=184)
 [![websiteup](https://img.shields.io/website.svg?down_color=red&down_message=down&up_color=green&up_message=up&url=https%3A%2F%2Fblog.tubone-project24.xyz)](https://blog.tubone-project24.xyz)
 
 ## What is this?
@@ -276,24 +277,39 @@ Use Terraform Cloud to change Netlify configuration values.
 
 [Workspace](https://app.terraform.io/app/tubone24-test/workspaces/blog)
 
-## Detect credentials leak
-
-[Gitguardian](https://www.gitguardian.com/)
-
 ## Alert monitoring
 
 Use [Sentry](https://sentry.io/organizations/tubone-project24/projects/)
 
-## Automatic security vulnerability
+## Automatic security and vulnerability check
+
+### Detect credentials leak
+
+There is a security risk of credentials getting into the code, but we use [Gitguardian](https://www.gitguardian.com/) to check each PR to make sure they are not mixed in.
+
+### API Based
 
 API request based security check is used by [Brightsec](https://brightsec.com/)
 
-Also, [Snyk](https://app.snyk.io/org/tubone24/project/f01f63e7-832e-45ca-a080-eb4d0da4b8e6), OSS Package check and code, IaC code check.
+### static code analysis for vulnerability
+
+We use [Snyk](https://app.snyk.io/org/tubone24/project/f01f63e7-832e-45ca-a080-eb4d0da4b8e6) for static code analysis.
+In addition to detecting vulnerabilities in the libraries used, we scan code and IaC tools.
 
 If you create PR, check security vulnerability for [snyk CLI](https://docs.snyk.io/snyk-cli) and push PR comment.
 
 ![snyk comments](https://i.imgur.com/fEL1cFj.png)
 
+### OWASP ZAP
+
+[OWASP ZAP](https://www.zaproxy.org/) [Full Scan](https://www.zaproxy.org/docs/docker/full-scan/) can be run securely against a locally built Docker container.
+
+The results can be viewed at the following URL
+
+<https://tubone24.github.io/blog/owasp/report.html>
+
+Full Scan of OWASP ZAP has a very long execution time, so manual execution with `workflow_dispatch` is recommended.
+
 # License
 
 - The source code under the MIT LICENSE.

From 183ad06df846626d01ad26e5d282e408cffc8cfe Mon Sep 17 00:00:00 2001
From: "yu.otsubo" <yu.otsubo@eventhub.jp>
Date: Sat, 31 Dec 2022 20:11:00 +0900
Subject: [PATCH 31/31] meta csp

---
 .github/workflows/owaspzap.yml |  3 +--
 README.md                      | 26 +++++++++++++++++++++++---
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/owaspzap.yml b/.github/workflows/owaspzap.yml
index d882ad3e19..cc5627e363 100644
--- a/.github/workflows/owaspzap.yml
+++ b/.github/workflows/owaspzap.yml
@@ -1,7 +1,6 @@
 name: OWASP ZAP Actions
 on:
   workflow_dispatch:
-  push:
 env:
   cache-version: v1
 jobs:
@@ -61,7 +60,7 @@ jobs:
         run: |
           chmod 777 owasp/zap
           docker-compose -f owasp/docker-compose-ci.yml up -d
-          docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -I -m 1 -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
+          docker-compose -f owasp/docker-compose-ci.yml exec -T owasp zap-full-scan.py -t http://web:9000 -r report.html -a -d -j -I -z "-config alert.maxInstances=0 -config view.locale=ja_JP"
       - name: Deploy Report
         uses: peaceiris/actions-gh-pages@v3
         with:
diff --git a/README.md b/README.md
index 8f72b46823..7320f090ab 100644
--- a/README.md
+++ b/README.md
@@ -68,6 +68,8 @@ Special, thanks!
 - unused dependencies check by [depcheck](https://www.npmjs.com/package/depcheck) in [depcheck_action](https://github.com/tubone24/depcheck_action)
 - Update dependencies by [Renovate](https://www.whitesourcesoftware.com/free-developer-tools/renovate/)
 - Detect browser's memory leaks by [memlab](https://github.com/facebookincubator/memlab)
+- Detect vulnerability by [Snyk](https://app.snyk.io/)
+- Detect vulnerability by [OWASP ZAP](https://www.zaproxy.org/)
 
 ### For contributor of articles
 
@@ -215,7 +217,7 @@ cp .env.example .env
 | STORYBOOK_ALGOLIA_INDEX_NAME     | Algolia search's APP ID                                  | posts   | 
 | STORYBOOK_ALGOLIA_SEARCH_API_KEY | Algolia search's index name                              | -       | 
 | GATSBY_GITHUB_CLIENT_ID          | GitHub oAuth Client ID, use Gitalk                       | -       | 
-| GATSBY_GITHUB_CLIENT_SECRET      | GitHub oAuth Client Secret, use Gitalk                   | -       | 
+| GATSBY_GITHUB_CLIENT_SECRET      | GitHub oAuth Client Secret, use Gitalk                   | -       |
 | FAUNADB_SERVER_SECRET            | FaunaDB's Secret, use FaunaDB                            | -       | 
 
 ## CI/CD
@@ -271,7 +273,9 @@ I use [textlint](https://textlint.github.io/) to proofread my blog text.
 yarn textlint
 ```
 
-## Change Netlify Config
+## Infrastructure
+
+### Change Netlify Config
 
 Use Terraform Cloud to change Netlify configuration values.
 
@@ -308,7 +312,23 @@ The results can be viewed at the following URL
 
 <https://tubone24.github.io/blog/owasp/report.html>
 
-Full Scan of OWASP ZAP has a very long execution time, so manual execution with `workflow_dispatch` is recommended.
+Full Scan of OWASP ZAP has a very long execution time, so manual execution with [workflow_dispatch](https://github.com/tubone24/blog/actions/workflows/owaspzap.yml) is recommended.
+
+## CI Healthy
+
+Last 14 days, CI Score by [meercode.io](https://meercode.io)
+
+### CI Score
+
+![blog Actions](https://api.meercode.io/badge/tubone24/blog?type=ci-score&lastDay=14)
+
+### CI Count
+
+![blog Actions](https://api.meercode.io/badge/tubone24/blog?type=ci-count&lastDay=14)
+
+### CI Success Rate
+
+![blog Actions](https://api.meercode.io/badge/tubone24/blog?type=ci-success-rate&lastDay=14)
 
 # License