Amazing Framework - a few suggestions!

[b-u-g-s]

Hi,

Having used your platform for a little less than 24h I am very new to it but can already tell how great this is!
So thank you so much for sharing it with the world.

I have a few comments/suggestions:

• When you look at a report and the code analysis part, in the code analysis part which gives a list of issue, it is great you can see what files is being referred to, but is there any way to have more information. For exemple, in one of the issue I got it said "The app uses an insecure Random Number Generator", I can see the files associated to this warning, the warning "Use of Insufficiently Random Values" but it would be great if it was also showing me that bit of code, that exact value/function that is a problem. As the tool detected this issue it must "know that". If I was to troubleshoot an APK with suspicious behaviours it would be great to get to that level of details. Granted, it is already an excellent pointer for further investigation! :)
• The NIAP Analysis has no links provided to the file affected by the alert, is it because it is the same information as the Code Analysis part?
• On the main dashboard it displays BIG numbers such as permissions / activities/ services/etc... it would be great if these were also hyperlink to the actual findings, i.e.: clicking on services would go to the page/anchor where the services are listed.
• It would be great to be able to compare different report with some sort of diff... so we can compare the differences between different apps. I am thinking here more about be able to compare different version of the same app... so we can see what issues have been introduced over time between a newer version and the previous version.

That's it for now :)
Thanks again.
B

[b-u-g-s]

Other comments for the local instance:

• Maybe the local.yml script could include a local default password creation?
• The main dashboard could have a link to the admin portal

[U039b]

Are you talking about the default admin password?
The main dashboard will never link to the admin portal to limit brute-force attack on it, that's a good practice advised by the Django project. In production, the admin panel is located at a random location, not at /admin.

[b-u-g-s]

I am just talking about a local installation not a production install.
How to make it so simple that you don't need to run additional command lines or know the backend infrastructure to access the admin/settings portal.
So if the platform was coming with a default admin password and links to the various admin portals for local install it would be very handy.

But I understand if you think it is not worth the risks/security trade off.
It just makes it more difficult for a "newbee" like me :)

[U039b]

Your first 2 suggestions are not related to Pithus directly but to MobSF. Regarding the 2 others, we should plan to add those features. Thank you for your suggestions.