Zaifliklarni boshqarish

| Aktiv | Turi | Muhitm | Egasi | Versiya | Internetga ochiqmi |
|-------|------|--------|-------|---------|-------------------|
| dokon.uz | Veb ilova | Prod | @husanboy | 2.3.0 | Ha |
| api.dokon.uz | API | Prod | @jasur | 2.3.0 | Ha |
| sinov.dokon.uz | Veb ilova | Staging | @jasur | 2.4.0-rc | Ha |
| db-01 | MySQL 8.0 | Prod | @aziz | 8.0.36 | Yo'q |
| redis-01 | Redis 7 | Prod | @aziz | 7.2.4 | Yo'q |
| ci.dokon.uz | GitLab | Ichki | @aziz | 16.8.1 | Ha |

# Tarmoqdagi qurilmalarni aniqlash (faqat o'z tarmog'ingizda!)
nmap -sn 10.0.1.0/24

# Ochiq portlar va xizmat versiyalari
nmap -sV -p- 10.0.1.15

# Bog'liqliklar inventarizatsiyasi - SBOM
composer show --format=json > sbom-php.json
npm list --json > sbom-js.json

# Standart formatda
syft dir:. -o cyclonedx-json > sbom.json

# SCA - bog'liqliklar
composer audit
npm audit --audit-level=high

# Konteyner
trivy image dokon:2.3.0
grype dokon:2.3.0

# Sirlar
gitleaks detect --source . --report-format json --report-path sirlar.json

# Statik tahlil
semgrep --config=p/security-audit --json --output=semgrep.json manba/

# CI da avtomatik skanerlash
name: Xavfsizlik skanerlash

on:
  push:
  schedule:
    - cron: '0 3 * * 1'      # har dushanba

jobs:
  bogliqliklar:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: composer audit
      - run: npm audit --audit-level=high

  sirlar:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: gitleaks/gitleaks-action@v2

  kod:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: returntocorp/semgrep-action@v1
        with:
          config: p/security-audit

  konteyner:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t dokon:test .
      - uses: aquasecurity/trivy-action@master
        with:
          image-ref: dokon:test
          severity: CRITICAL,HIGH
          exit-code: 1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H  →  9.8 (Kritik)

final class ZaiflikBaholovchi
{
    public function ustuvorlik(Zaiflik $z, Aktiv $a): Ustuvorlik
    {
        $ball = $z->cvss;

        // Internetga ochiqmi?
        $ball *= $a->internetgaOchiq ? 1.5 : 0.7;

        // Ekspluatatsiya ommaviy mavjudmi?
        $ball *= $z->ekspluatatsiyaMavjud ? 1.4 : 1.0;

        // Faol foydalanilmoqdami?
        $ball *= $z->faolFoydalanilmoqda ? 2.0 : 1.0;

        // Aktiv muhimligi
        $ball *= match ($a->muhimlik) {
            Muhimlik::Kritik => 1.5,
            Muhimlik::Yuqori => 1.2,
            Muhimlik::Ortacha => 1.0,
            Muhimlik::Past => 0.6,
        };

        // Chora ko'rilganmi?
        $ball *= $z->choraKorilgan ? 0.4 : 1.0;

        return Ustuvorlik::balldan(min($ball, 15.0));
    }
}

# Zaifliklar reyestri

| ID | Aktiv | Zaiflik | CVSS | Ustuvorlik | Holat | Mas'ul | Muddat |
|----|-------|---------|------|-----------|-------|--------|--------|
| Z-001 | api.dokon.uz | SQL inyeksiya (qidiruv) | 9.1 | Kritik | Tuzatilmoqda | @jasur | 2026-08-17 |
| Z-002 | dokon.uz | Eskirgan guzzle (CVE-2026-1234) | 7.5 | Yuqori | Rejada | @husanboy | 2026-08-22 |
| Z-003 | db-01 | MySQL 8.0.32 (yangilanish kerak) | 6.5 | O'rta | Rejada | @aziz | 2026-09-15 |
| Z-004 | sinov.dokon.uz | Katalog ro'yxati ochiq | 4.3 | Past | Qabul qilindi | @jasur | — |
| Z-005 | dokon.uz | CSP yo'q | 5.4 | O'rta | Tuzatildi | @husanboy | 2026-08-10 |

enum ZaiflikHolati: string
{
    case Yangi          = 'yangi';
    case Tasdiqlangan   = 'tasdiqlangan';
    case Rejada         = 'rejada';
    case Tuzatilmoqda   = 'tuzatilmoqda';
    case Tuzatildi      = 'tuzatildi';
    case Tekshirildi    = 'tekshirildi';
    case QabulQilindi   = 'qabul_qilindi';   // xavf qabul qilindi
    case SoxtaIjobiy    = 'soxta_ijobiy';
}

# Zaiflik bizga tegishlimi?
composer why guzzlehttp/guzzle

# Yangilash
composer update guzzlehttp/guzzle --with-dependencies

# Faqat xavfsizlik yangilanishlari
composer update --with-all-dependencies --prefer-stable

# Xavfsizlik siyosati

Biz xavfsizlik tadqiqotchilarining ishini qadrlaymiz.

## Zaiflik topsangiz

Iltimos, quyidagi manzilga xabar bering:
**[email protected]** (PGP kaliti: /pgp.txt)

Xabarda ko'rsating:
- Zaiflik turi va joylashuvi
- Takrorlash qadamlari
- Potensial ta'sir
- Ekran surati yoki namoyish (agar bo'lsa)

## Bizning majburiyatimiz

- 48 soat ichida javob beramiz
- 7 kun ichida dastlabki baho beramiz
- Tuzatish jarayoni haqida xabardor qilamiz
- Ruxsatingiz bilan hurmat ro'yxatiga kiritamiz

## Doira

Kiradi:
- dokon.uz, api.dokon.uz
- Mobil ilovalar

Kirmaydi:
- sinov.dokon.uz (sinov muhiti)
- Uchinchi tomon xizmatlari
- DDoS hujumlari
- Ijtimoiy muhandislik
- Jismoniy hujumlar

## Qoidalar

- Faqat o'z hisobingiz bilan sinang
- Ma'lumotni o'chirmang va o'zgartirmang
- Xizmatga zarar yetkazmang
- Zaiflikni tuzatilgunga qadar oshkor qilmang
- Boshqa foydalanuvchilar ma'lumotiga kirmang

Ushbu qoidalarga rioya qilgan tadqiqotchilarga qarshi huquqiy
chora ko'rilmaydi.

# /.well-known/security.txt
Contact: mailto:[email protected]
Expires: 2027-01-01T00:00:00.000Z
Encryption: https://dokon.uz/pgp.txt
Preferred-Languages: uz, ru, en
Policy: https://dokon.uz/xavfsizlik-siyosati
Acknowledgments: https://dokon.uz/hurmat

# Mukofot jadvali

| Jiddiylik | Mukofot |
|-----------|---------|
| Kritik (9.0-10.0) | $2000 - $5000 |
| Yuqori (7.0-8.9) | $500 - $2000 |
| O'rta (4.0-6.9) | $150 - $500 |
| Past (0.1-3.9) | $50 - $150 |

Qo'shimcha: yaxshi hisobot uchun bonus

| Ko'rsatkich | Maqsad | Joriy |
|-------------|--------|-------|
| Ochiq kritik zaifliklar | 0 | 1 |
| Ochiq yuqori zaifliklar | < 5 | 3 |
| Kritikni tuzatish o'rtacha vaqti | < 2 kun | 3.2 kun |
| Yuqorini tuzatish o'rtacha vaqti | < 7 kun | 5.8 kun |
| Skanerlash qamrovi | 100% | 92% |
| Muddati o'tgan zaifliklar | 0 | 2 |
| Soxta ijobiy foizi | < 30% | 41% |

# Dependabot
version: 2
updates:
  - package-ecosystem: "composer"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 10
    labels: ["xavfsizlik", "bogliqliklar"]
    reviewers: ["husanboy"]

  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"

// Zaiflik xabarlarini avtomatik qayta ishlash
final class ZaiflikXabarnomasi
{
    public function qabulQiling(array $xabar): void
    {
        $zaiflik = Zaiflik::xabardan($xabar);

        $tegishliAktivlar = $this->inventar->sbomBoyichaQidiring(
            $zaiflik->paket,
            $zaiflik->tasirlanganVersiyalar,
        );

        if ($tegishliAktivlar === []) {
            $this->jurnal->info('Zaiflik bizga tegishli emas', [
                'cve' => $zaiflik->cve,
            ]);

            return;
        }

        foreach ($tegishliAktivlar as $aktiv) {
            $ustuvorlik = $this->baholovchi->ustuvorlik($zaiflik, $aktiv);

            $vazifa = $this->vazifalar->yarating([
                'sarlavha'   => "[{$ustuvorlik->name}] {$zaiflik->cve} - {$aktiv->nomi}",
                'tavsif'     => $zaiflik->tavsif,
                'mas_ul'     => $aktiv->egasi,
                'muddat'     => $ustuvorlik->muddat(),
                'yorliqlar'  => ['xavfsizlik', $ustuvorlik->value],
            ]);

            if ($ustuvorlik === Ustuvorlik::Kritik) {
                $this->ogohlantiruvchi->darhol($vazifa);
            }
        }
    }
}