diff --git a/fuzzing/README.md b/fuzzing/README.md index 2c8e7d7..85f67d0 100644 --- a/fuzzing/README.md +++ b/fuzzing/README.md @@ -23,11 +23,15 @@ A secure web server must be capable of receiving mass amount of malicious input * EchoServer * BroadcastingEchoServer +### Fuzzing at the syscall level is done using libEpollFuzzer for: + +* EchoServer + No defects or issues are left unfixed, covered up or otherwise neglected. In fact we **cannot** cover up security issues as OSS-Fuzz automatically and publicly reports security issues as they happen. Here is the list of public issues (issues are kept private for 90 days or until fixed): https://bugs.chromium.org/p/oss-fuzz/issues/list?q=label%3AProj-uwebsockets&can=1 -Currently we are at ~90% total fuzz coverage and OSS-Fuzz is reporting **zero** issues whatsoever. The goal is to approach 100% total coverage. +Currently we are at **99.5%** function coverage, **~90%** line coverage and OSS-Fuzz is reporting **zero** issues in our codebase whatsoever. The goal is to approach 100% total coverage. -### Security awards +### Security rewards Google have sent us thousands of USD for the integration with OSS-Fuzz - we continue working on bettering the testing with every new release.