From 521573933d7f70d9fc1cd1bcf2407d2047f73b37 Mon Sep 17 00:00:00 2001 From: Alex Hultman Date: Fri, 7 Aug 2020 17:24:12 +0200 Subject: [PATCH] Update README.md --- fuzzing/README.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fuzzing/README.md b/fuzzing/README.md index 2c8e7d7..85f67d0 100644 --- a/fuzzing/README.md +++ b/fuzzing/README.md @@ -23,11 +23,15 @@ A secure web server must be capable of receiving mass amount of malicious input * EchoServer * BroadcastingEchoServer +### Fuzzing at the syscall level is done using libEpollFuzzer for: + +* EchoServer + No defects or issues are left unfixed, covered up or otherwise neglected. In fact we **cannot** cover up security issues as OSS-Fuzz automatically and publicly reports security issues as they happen. Here is the list of public issues (issues are kept private for 90 days or until fixed): https://bugs.chromium.org/p/oss-fuzz/issues/list?q=label%3AProj-uwebsockets&can=1 -Currently we are at ~90% total fuzz coverage and OSS-Fuzz is reporting **zero** issues whatsoever. The goal is to approach 100% total coverage. +Currently we are at **99.5%** function coverage, **~90%** line coverage and OSS-Fuzz is reporting **zero** issues in our codebase whatsoever. The goal is to approach 100% total coverage. -### Security awards +### Security rewards Google have sent us thousands of USD for the integration with OSS-Fuzz - we continue working on bettering the testing with every new release.