New in Dradis Pro v4.14

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

Associate and sync content between issues and Issue Library entries

Issues and Issue Library entries are now synced. When you add an Issue to your project from the Issue Library, it is synced up with the original Issue Library entry. That way, you can identify when the two are out of sync and, if needed, sync them back up.

You can update either the Issue in your project to match the Issue Library entry, or update Entry to match your Issue Library entry – it works both ways!

This link between the issue and the entry is also created when you send an already existing Issue from your project to the Issue Library. Managing your reusable Issues has never been as easy as it is now!

Quality Assurance for Issue Library

We implemented QA for the Issue Library. You can now review your Issue Library entries and perform quality assurance on them.

When entries are marked as “Ready For Review”, they’re available in the new QA view. You can edit them, change their state, and keep track of changes with the version history.

Liquid support for Issue Sort fields

Liquid support for Issue sorting fields. When you export a report to Word, you can set a numeric sorting field, and your issues will be sorted in descending order on export.

This update allows that field to contain Liquid in the Val values without affecting the sort order. The result of the Liquid code will be used in the sorting, not the Liquid code itself.

Release Notes

  • Issue Library:
    • Associate issues with Issue Library entries
    • Sync content between associated issues and Issue Library entries
    • Implement a Quality Assurance view for Issue Library entries
  • Kit Import:
    • Use file name sequencing when a template file with the same name exists
  • Upgraded gems:
    • concurrent-ruby, et-orbi, fugit, puma, rexml
  • Bug fixes:
    • Report Templates:
      • Fix confirmation on deleting a report template
    • Spelling:
      • Restore functionality of native browser back/forward buttons
  • Integration enhancements:
    • Business Intelligence:
      • Show search results in a data table
  • Reporting enhancements:
    • Word:
      • Allow fields that contain Liquid to be used as an export sorting field
      • Ignore Tag field when auto-generating word template properties

Not using Dradis Pro?

New in Dradis Pro v4.13

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

Liquid updates

Dradis v4.13.0 expands what you can do with Liquid content. Support for Liquid drops has been expanded so that they are available at more levels. For example, perhaps you want to have an auto-magically generated text in an Executive Summary ContentBlock that summarises recommendations for Issues and their respective Evidence locations, in order of severity? Now you can do that!

In addition, we have tweaked the Word exporter so that Liquid content is evaluated before Word filters. That means that you can use Liquid syntax to programmatically set filters. For example, perhaps you have filters in your Word template that separate Internal and External Issues. Now you can use Liquid to, for example, specify that if an Issue is found on a Node beginning in 192. then the Type should be set to “Internal”.

Or perhaps you want to select which ContentBlock sections to display based on the Project type as defined in a document property? Now, with some Liquid code in the relevant ContentBlock filter sections, you can do that!

Project Scheduler integration

The Project Scheduler is one of our most downloaded add-ons, and a frequently requested feature has been integrated with third-party calendars. This is now implemented in v4.13.0! The Scheduler now has a secure link to a .ics that will let you integrate the Dradis Project Scheduler with apps like Outlook, Thunderbird, and Apple Calendar. The .ics file can of course also be downloaded rather than linked.

Auto-generate Word report template properties

Correct configuration of Word templates’ Report Template Properties is essential to ensure that projects are correctly generated, validated, and exported. With our recent Mappings Manager overhaul with per-template mappings, the correct configuration of report template properties is also essential to tool uploads. To make this process easier for you, Dradis can now auto-detect report template properties when you upload a report template to your Dradis instance. If you create or tweak your own templates, and don’t want to go through a fiddly .rb file to configure a new Kit each time, this feature is for you!

Release Notes

  • Liquid: Make project-level collections available for Liquid syntax
  • Validations: Evaluate Liquid syntax before validating the fields
  • Upgraded gems: nokogiri, rails, redcloth, rexml
  • Bug fixes:
    • Business Intelligence:
      • Prevent the “Business Intelligence” navigation label overflowing (in Project and Team forms) on mid-size view ports
      • Prevent the “Compare” chart y-axis label from being covered by chart data
    • Navigation: Restore functionality of native browser back/forward buttons
    • Rules Engine: Prevent issues from getting multiple tags
    • Tables: Enable sorting by validation column status
    • Word: Prevent EvidenceCounter filters from being ignored
  • Integration enhancements:
    • Calculators: Add CVSS/Dread calculators to the Tools Manager
    • Rules Engine: Process Liquid syntax before matching field condition
  • Reporting enhancements:
    • Word:
      • Auto-generate fields for uploaded templates
      • Process Liquid before generating the Word report
      • Remove the NoSpacesInNodesValidator
      • Skip QA validation when exporting all the records
  • Security Fixes:
    • Medium: Authenticated (author) horizontal privilege escalation affecting attachments

Not using Dradis Pro?

New in Dradis Pro v4.12

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

New Mappings Manager

Dradis v4.12.0 contains a complete overhaul of how the Mappings Manager works. Mappings Manager configurations for each upload plugin (e.g. Nessus, Burp, Qualys…) are now directly associated with a particular report template and its associated report template properties. This means that you can have separate plugin mappings for separate report templates.

The editor itself has also been overhauled to be more user-friendly. Rather than having to manually type out the Dradis fields needed using their #[Field]# syntax, you can now pick “Source Fields” and “Dradis Fields” from dropdowns. Of course “Custom Text” and “Custom Field” options are also available.

This overhaul should also make it more straightforward to configure the Mappings Manager for report templates in Kits.

Your existing Mappings Manager configurations will be migrated to the new format on upgrade.

CVSSv4 Calculator

We heard you, now we support a CVSSv4 calculator right in the application!

Of course CVSSv3.0 and CVSSv3.1 are still supported as well. Pick your preferred version from the dropdown. You can have the outputs of multiple calculator versions in the same Issue if you like.

API Attachments

New funcionalities have been added to the API Attachments endpoint. You can now get the size, created_at, and (by popular request) a download link with an API call!

AWS and Azure images now officially supported

After a long time in Beta, we are now able to offer our Dradis images for AWS and Azure as officially supported by us, as long as our documented AWS or Azure deployment methods are followed.

Release Notes

  • Attachments: Add size, created_at, and download link to the API
  • Kits: Automate creating Mappings
  • Mappings Manager: Map fields from scanner integrations to Dradis fields
  • Upgraded gems:
    • nokogiri, rails
  • Bugs fixes:
    • Avatars: Allow both .jpg and .jpeg formats
    • Projects: Fix redirection when updating an issue or content block
    • Sidebar: Prevent version number from overlapping listed records
  • New integrations:
    • Pentera
  • Integration enhancements:
    • CVSS Calculator: Add CVSS v4 support
    • Integration Manager: Clarify integration status after enabling/disabling
    • Veracode:
      • Create evidence for every instance of <flaw>
      • Use cweid as the issue identifier
  • Reporting enhancements:
    • Word: Accept scope parameter in command line export
    • Excel: Accept scope parameter in command line export
  • Security Fixes:
    • High: Authenticated author path traversal on attachment rename

Not using Dradis Pro?

Top 10 tables – a custom Dradis script

Imagine, you scan a few hundred hosts to create a summary report. You want to show data on ports and operating systems without giving the end user hundreds of pages of data. Enter the “Top 10” script!

Credit for this script idea goes to Chris from I.S. Partners. He reached out via the support inbox to see if we could create a “Top 10” script that would do the following:

  1. Create an array of all of the operating systems, ports/protocols, and services in the project
  2. Deduplicate the arrays and count the number of instances
  3. Narrow down the array to the top 10 based on the number of instances
  4. Update a Content Block in the project with a textile table based on each array

The script assumes that you have a Content Block with the Type field set to “Top10” with the following fields:

  • PortScanning
  • OSEnumeration
  • ServiceEnumeration

Head to our scripting repo and check out the “Top 10” script. To use it:

1. SCP the top10.rb file to your instance (e.g. to the /tmp folder)

2. In the browser, find the project ID of the project that you need to update. For example, if your project lives at /pro/projects/123 in the browser, the ID is 123.

3. Run the following in the command line as “dradispro”:
$ cd /opt/dradispro/dradispro/current/
$ RAILS_ENV=production bin/rails runner /tmp/top10.rb <project_id>

You’ll need to sub in your project ID (Step #2 above) for “<project_id>” above! Example:

$ RAILS_ENV=production bin/rails runner /tmp/top10.rb 123

When the script completes, you’ll see this output in the console:

Port Scanning table updated!
Service Enumeration table updated!
OS Enumeration table updated!

After running the script, you can refresh the Top 10 content block to see the updated tables:

Chris reported that with their largest Nessus file (125MB), the script was able to perform the calculations successfully in less than 30 seconds. We’re optimistic about a similar script’s performance with your projects.

This script will need to be adjusted to meet your individual team’s specific requirements and preferences. But, we think it’s a promising option for teams who prefer not to use VBA or want to create similar tables in their Word reports.

If you need any help customizing this script to meet your specific use case, please reach out to our support team. Or, if you have ideas for improvements, please fork the repo and post in our users forum.

A Year of Updates [2023] – Dradis Pro

Dradis exists to give pentesting teams more time to do what they do best, cutting the busywork from cybersecurity projects by automating pentest reporting and streamlining collaboration.

To achieve this, we’re continually improving the product. Fixing bugs and adding/improving features. 

2023 was a busy year at Dradis, with dozens of bugs fixed, and a bunch of new and improved features.

Improved reporting and testing features

  • Inline code support
  • Adding liquid content to Word and HTML reports
  • Improved filters in Word templates
  • Mappings Manager available for Azure DevOps and Jira 
  • Quality assurance 
  • Custom tag management

Improved admin and support features

  • Archiving projects – rather than moving them into the trash
  • Opt-in usage analytics 
  • Improved administrator powers

Improved reporting and testing features

Inline Code Support

v4.7

We already supported code blocks, but now, you can use @ symbols to create in-line code inside of your Dradis project:

Screenshot of the Dradis Pro inline code support feature update

When you export this to a Word report that has a custom InlineCode character style, you’ll get that code styled automatically:

Screenshot of the inline code output in Dradis Pro

Liquid Dynamic Content in Word and HTML reports

v.4.9

We have already supported Liquid content in Dradis Gateway templates for a while – now we are bringing Liquid Dynamic Content to Word and HTML reports as well.

Want to refer to document properties like dradis.client inside a ContentBlock? Want to show the count of evidence inside the text of an Issue? Want to use conditionals like “If this property is in Spanish, export this issue in Spanish instead of English”? Now you can!

Better filters in Word templates

v.4.9

We now have two more filtering options available in Word: Filters with spaces, and filters on Nodes.

Filtering with spaces means you can use double quotes in both field names and filter values. For example, you can filter by “CVSS Base"|(9.0..10.0) or Category|"A1 Injection“.

Nodes can be filtered by Node Properties. For example, if you have a Node property for type with values of internal/external, you can filter a Node by type|internal to only see content for internal-type Nodes.

Mappings Manager for Azure DevOps and Jira

v4.10

What was previously the Plugin Manager is now the Mappings Manager as we’ve extended the functionality to Azure DevOps and Jira. You told us that you usually have a pattern for the data that you send to these external tools. For example, you’d want a specific set of fields from your Dradis issue to go into your Jira card’s description.

Screenshot of the Mappings Manager for Azure DevOps and Jira in Dradis pro

The Mappings Manager allows you to configure that mapping so that the next time you send an Issue to Azure DevOps or Jira, the editor will pre-populate with the data from your Issue in the exact format you specified. You’ll still have the ability to edit it before sending the Issue to Azure DevOps or Jira if needed.

Screenshot of an issue being mapped to Azure DevOps

Quality Assurance

v4.8

Review/approve Issues and Content Blocks before including them in reports.

The goal here was to give you a way to differentiate between “I’ve reviewed this issue” and “I haven’t reviewed this issue yet”.

Screenshot showing how you can review/approve Issues and Content Blocks before including them in pentest reports.

You can use the new QA view to look at your “Ready for review” Issues and Content Blocks and review them before including them in reports.

Dradis v4.8.0 has a Quality Assurance feature to approve Issues and Content Blocks before reporting

Then, on the Export page, the default is to export just the Published records. But, you can also export All if that makes more sense for your team’s workflow.

Dradis Pro Export Manager Screenshot

Custom Tag Management

v4.7

Previously, you could create custom tags by editing the XML of the project template directly. That’s still an option if you happen to enjoy dealing with XML. Otherwise, you can now use the UI for that whole process. There’s even a color picker so that you can get just the right shade for your custom tags.

Screenshot of Custom Tag Management
 in Dradis Pro

From the project level, you can also manage your tags and create, edit, or delete them as needed:

Screenshot of tags management overview

Improved admin and support features

Archiving projects – rather than moving them into the trash

v4.10

Previously, we had active projects or projects in the Trash and nothing in between. You asked for another way to organize projects and we delivered! Now, you can archive projects as well. Archiving a project does not delete a project, but leaves it in the Archive tab of the Projects view. This way you can maintain an uncluttered view of active projects without needing to send inactive projects to the trash.

Screenshot of managing and archiving projects

Opt-in Usage Analytics

v4.7

Before v4.7, we had no way to receive usage data from your instance other than a ping to our licensing server when you first activate the instance. In v4.7, we have rolled out optional usage analytics that you can share with us. Yes, optional!

For full transparency, you can see exactly what you would be sending to us in the event log. It’s all anonymized data like “someone exported a Word report” or “someone logged in as a contributor” that is designed to help us understand how teams are using Dradis and should not reveal anything sensitive, not even your email address.

Opt in usage analytics screenshot

Of course, you can always opt out of sharing this data with us if you prefer. We’re excited to have a bit more information about how you’re currently using Dradis so that we can make the product even better for everyone in the future.

Tester Administration

v4.8

We’ve also added better in-app tester administration. If a user gets locked out of their account with too many incorrect login attempts, Admin users will now be able to unlock their account with 1 click.

Screenshot of Dradis pro admin manager

v4.11 – the latest release

We’ve continued releasing updates in 2024, here’s an overview of our latest release:

  • Improved version history
  • Fixed liquid dynamic content preview in the editor
  • Fixed export crashing with links with trailing special character
  • Fixed link formatting for hyperlinks in inline code blocks

Check out the full release notes.

Not using Dradis Pro?

New in Dradis Pro v4.11

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

Bug Fixes

Dradis v4.11.0 is full of bug fixes and technical updates. You may not see brand new features or changes to the UI but we fixed many, many different things behind the scenes. We also updated some behind-the-scenes aspects like the rails version.

Improved version history

We’ve improved the version history and the way that it displays. Previously, the entire line/paragraph would be marked as changed, even if a single word was changed. Check out the new and improved version!

Fixed liquid dynamic content preview in the editor

We’ve also improved the way that Liquid Dynamic Content previews in the editor

Fixed export crashing with links with trailing special character

Previously, exports would crash if you included a link with a trailing special character. No more!

Fixed link formatting for hyperlinks in inline code blocks

We’ve also fixed the formatting of links inside code blocks so that they appear in the report exactly how you’d expect them to appear.

Release Notes

  • Assets: Add importmap-rails to handle js libraries
  • Liquid: Add LiquidAssignsService
  • nginx: Add HTTP/2 support
  • Revision history: Improve version history for content with carriage return
  • Tylium: Show liquid content in editor preview
  • Web-server: Replace unicorn with puma in production
  • Validation: Display attachment validator errors when viewing/editing a record
  • Flash alert: Allow the ‘license about to expire’ alert to be dismissed for the session
  • Upgraded gems:
    • rails, resque-scheduler
  • Bug fixes:
    • Code blocks: Remove extra padding and background for code elements outside of projects
    • Contributors: Expire one time token after login
    • Evidence: Prevent loading old Evidence template content at the Issue level
    • Methodologies: validate presence of content
  • Integration enhancements:
    • Authentication Integrations: Use the AuthenticationStrategies class for Rails 7 support
    • Burp: Fix compatibility with nokogiri >= 1.15
    • Nexpose:
      • Add port/protocol to evidences
      • Use the details in <os> as the OS node property
      • Import `vulnerability.risk_score` as a new Issue field
      • Allow multiple evidence with the same test id & node address
    • Qualys: Add support for the output for Qualys WAS API 3.13 and later
  • Reporting enhancements:
    • Word:
      • Fix export crashing with links with trailing special characters
      • Skip link formatting for hyperlinks in inline code blocks
  • Security Fixes:
    • Low: Authenticated (author) information disclosure
      • After a user has been removed from a project, they may still get notifications for Issues they were subscribed to, resulting in the disclosure of Issue titles.
    • Low: Information Disclosure in the Output Console of Upload Manager

Not using Dradis Pro?

New in Dradis Pro v4.10

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

Validate your projects before your export

How many times have you gone to export a report and realized later that there was an error that the validator caught, you just didn’t validate first? Now, the validation is built into the exporter so that you’ll always get a heads-up about possible problems and can fix them before exporting the report. In the case of false positive validator warnings, you’ll have the option to bypass the errors and continue with the export.

If there are no validation errors, the export will proceed with no extra clicks necessary!

Mappings Manager for Azure DevOps and Jira

What was previously the Plugin Manager is now the Mappings Manager as we’ve extended the functionality to Azure DevOps and Jira. You told us that you usually have a pattern for the data that you send to these external tools. For example, you’d want a specific set of fields from your Dradis issue to go into your Jira card’s description.

The Mappings Manager allows you to configure that mapping so that the next time you send an Issue to Azure DevOps or Jira, the editor will pre-populate with the data from your Issue in the exact format you specified. You’ll still have the ability to edit it before sending the Issue to Azure DevOps or Jira if needed.

Archiving projects

Previously, we had active projects or projects in the Trash and nothing in between. You asked for another way to organize projects and we delivered! Now, you can archive projects as well. Archiving a project does not delete a project, but leaves it in the Archive tab of the Projects view. This way you can maintain an uncluttered view of active projects without needing to send inactive projects to the trash.

New Methodologies REST API endpoint

You can now access Methodology data including Boards, Lists, and Cards via the REST API.

Release Notes

  • Report Template Properties: Add fields with “String” type by default
  • Tylium: Consolidate sidebars
  • Integration Manager:
    • Add error handling for enabling/disabling and installing incompatible files
    • Add the HTML Exporter to the Tools Manager
  • Plugin Manager: Add support for Liquid content in templates
  • Users: Add support for longer TLDs in user emails
  • Projects: Allow archiving of projects
  • Upgraded gems:
    • font-awesome-sass, nokogiri, puma, rails, sanitize, selenium-webdriver
  • Bug fixes:
    • Activity Feed:
    • Correctly render icons for each activity in the feed
    • Export:
    • Prevent exporting reports when the exporter doesn’t have any templates
    • Exclude blank and n/a values from range filters
    • QA: Enable @mentions and formatting toolbar for comments in QA show views
  • Integration enhancements:
    • Azure DevOps: Implement Mappings Manager for Azure DevOps
    • HTML Export
    • Add to the Tools Manager
    • Fix default templates
    • Prevent exporting reports without any HTML templates
    • JIRA
    • Add support for Liquid when sending issues to JIRA
    • Implement Mappings Manager for JIRA
    • Implement ticket assignment when sending issues to JIRA
    • Fix Author authorization when sending an issue to JIRA
    • Send attachments included in an issue to JIRA
    • WPScan: Import “version” findings with status: outdated
  • Reporting enhancements:
    • Word: Validate project before export
  • REST/JSON API enhancements:
    • Boards, Lists, Cards: add initial implementation
  • Security Fixes:
    • Medium: Authenticated (author) broken access control: read access to system files

Not using Dradis Pro?

Dradis v4.8.0 has a Quality Assurance feature to approve Issues and Content Blocks before reporting

New in Dradis Pro v4.9

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

Liquid Dynamic Content in Word and HTML reports

We have already supported Liquid content in Dradis Gateway templates for a while – now we are bringing Liquid Dynamic Content to Word and HTML reports as well.

Want to refer to document properties like dradis.client inside a ContentBlock? Want to show the count of evidence inside the text of an Issue? Want to use conditionals like “If this property is in Spanish, export this issue in Spanish instead of English”? Now you can! For example, the following will export into an Issue:

#[Description]#
Global:
{{ project.name }} for {{ team.name }} team
{{document_properties.available_properties}}
 
Tag Name:
{% for tag in issue.tags %} {{ tag.name}} {%endfor%}
 
CVSSv3 score:
{{ issue.fields['CVSSv3.BaseScore'] }}
 
Evidence:
{% for evidence in issue.evidence %} {{ evidence.fields["Label"] }} {%endfor%}
 
The {{ issue.title }} issue has {{ issue.evidence.size }} instances of Evidence
 
Evidence count per node:
{% for node in issue.affected %}
{{ node.label}} has {{node.evidence.size}} instances of evidence
{% endfor %}

It would give a result like the following:

Better filters in Word templates

We now have two more filtering options available in Word: Filters with spaces, and filters on Nodes.

Filtering with spaces means you can use double quotes in both field names and filter values. For example, you can filter by "CVSS Base"|(9.0..10.0) or Category|"A1 Injection".

Nodes can be filtered by Node Properties. For example, if you have a Node property for type with values of internal/external, you can filter a Node by type|internal to only see content for internal-type Nodes.

DuoWeb and ServiceNow support in the Integration Manager

We have changed the way our integrations work, so you can now install DuoWeb and ServiceNow right in the Integration Manager. No need to use the command line to install 2FA! You can also configure Duo and ServiceNow, as well as integrations like Azure DevOps, right in the Integration Manager.

Release Notes

  • AccessTokens: allow the storage of per-user encrypted tokens
  • QA: Show state changes in activity feed
  • Sessions: Store :secret_key_base in encrypted configuration file
  • Tylium: Extend support for Liquid Dynamic Content
  • Upgraded gems:
    • bootstrap, popper_js, simple_form
  • Bugs fixes:
    • Issue Library: Prevent rendering navbar over top of the fullscreen editor
    • QA: Redirect to correct view when changing states on QA edit views
    • Users: Force logout for users with locked accounts
  • Integration enhancements:
    • Acunetix: Parse inline code, not just code blocks
    • Burp: Adds strong and code tags parsing
    • CSV: Fix CSV Upload for files with special characters
    • Nessus:
      • Parse code tags as inline code
      • Add plugin_type as an available Issue field
    • Nexpose:
      • Parse inline code, not just code blocks
      • Wrap ciphers in the ssl-weak-message-authentication-code-algorithms finding
    • Qualys: Adds Request/Response Evidence fields for Web Application Scans (WAS)
    • Azure DevOps: Switch authentication from PAT to OAuth2
    • Duo 2FA:
      • Migrate to UI-based configuration
      • Add to Integrations Manager
    • ServiceNow:
      • Migrate to UI-based configuration
      • Add to Integrations Manager
  • Reporting enhancements:
    • Word
      • Add support for filtering nodes by properties
      • Add support for the notextile tag
      • Allow multi-word fields/values in the content control filters with double quotes
      • Extend support for liquid dynamic content in Word reports
      • Warn of missing blank lines around a screenshot only when it’s not the first or last item in a field

Not using Dradis Pro?

What I learned attending RailsConf 2023

I was fortunate enough to attend RailsConf Atlanta 2023, and in this post I share some of the thoughts that I gathered while reflecting upon the conference.

What is RailsConf?

RailsConf is a Ruby on Rails developer’s dream. It’s a place where some of the best Rails developers come together once a year to share knowledge and expertise, and meet like-minded individuals. You have the ability to attend workshops from Rails developers that have large YouTube followings, and attend talks that discuss in-depth technical topics. It was an action-packed 3 days, and the best part was how welcoming and diverse the Rails community is!

We’re a small organization, but we have a mighty team!

As the days went on, I began to reflect and compare my experience at Security Roots with what others were sharing about their own working lives. I met developers from all over the USA, Canada and Europe. As we were discussing the different ways that our companies operate, and I was sharing my experience about how we work at Security Roots, it was apparent that we’re doing something special here.

Working asynchronously is no easy feat, but our founder has figured out a formula for making this working model a success.

“How do you get work done if you don’t have meetings?” One developer asked me.

I laughed as this was a common question I was getting.

It was interesting to learn that we had just as many, if not more, releases than most other teams over the past 8 months.

“We have great documentation, and everybody takes ownership of their work. I said. “We find information ourselves, only asking others if we have looked extensively first. We get things done because we know that there isn’t anyone else who’s going to do it for us.

I watched as they stared back at me with confusion, surprise, and undoubtedly one thousand questions running through their mind.

It was eye-opening to learn about other team structures, and what other developers’ day to day work lives look like.

Personal Growth

As a developer relatively early in my career, I am excited by the learning opportunities presented to me each day. Some of them include:

  • Learn the inner workings of virtual machines through debugging with users
  • Interact directly with users to determine what’s working and what’s not working for them, which informs my day-to-day work.
  • Work with a team of people from all over the world, everyone bringing a unique perspective to our work.
  • Take creative freedom in my solutions, and discuss them with my team.

Despite not having meetings, we are a very collaborative and close-knit team, and this is the greatest thing about working at Security Roots.

After coming back, I couldn’t wait to share what I gathered at the conference with my team. Most notably, that what we accomplish with a small team is remarkable. We produce and release more than many other larger teams, without sacrificing quality.

I felt inspired and excited to come back to my team and write beautiful Rails code!

I learned a lot at RailsConf, including:

  • How to contribute to the framework
  • How the inner workings of some of the most abstract parts of the framework function
  • How best to manage incoming Webhooks (from the master himself, Chris Oliver)
  • New command line tools that I can leverage every day
  • New ways of approaching problems.

It was great to be surrounded by so many Ruby on Rails developers who are just as passionate about their craft as I am.

I hope to take more members of the team with me next year!

Dradis v4.8.0 has a Quality Assurance feature to approve Issues and Content Blocks before reporting

New in Dradis Pro v4.8

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

Quality Assurance

Review/approve Issues and Content Blocks before including them in reports.

The goal here was to give you a way to differentiate between “I’ve reviewed this issue” and “I haven’t reviewed this issue yet”.

You can use the new QA view to look at your “Ready for review” Issues and Content Blocks and review them before including them in reports.

Then, on the Export page, the default is to export just the Published records. But, you can also export All if that makes more sense for your team’s workflow.

Tester Administration

We’ve also added better in-app tester administration. If a user gets locked out of their account with too many incorrect login attempts, Admin users will now be able to unlock their account with 1 click.

Release Notes

  • Quality Assurance: Review/approve Issues and Content Blocks before including them in reports
  • Tester Administration: Add unlock button to UI for locked Testers
  • Integration enhancements:
    • JIRA: Add support for Jira Data Center v8.4+
  • Upgraded gems:
    • rack, rails, time
  • Bug fixes:
    • Kits: Enable import of kit with no project template
  • Security Fixes:
    • Medium: Authenticated (author) persistent cross-site scripting

Not using Dradis Pro?