Re-Enable features.md search

[paulOsinski]

This feature summary page is useful in search until we get more "Tags" documentation written, so it should not be excluded from search.

[dryrunsecurity]

DryRun Security Summary

DefectDojo Pro repository underwent multiple configuration updates with security findings related to credential handling, workflow scripts, OIDC configuration, and potential token/API security risks.

Expand for full summary

Summary: Multiple configuration and documentation updates across DefectDojo Pro repository, including GitHub workflows, changelog updates, and dependency modifications.

Security Findings:

1. Sensitive Credential Handling in PR Reminder Script

   • Hardcoded mapping of GitHub usernames to Slack email addresses
   • Uses environment variables for GitHub and Slack tokens
   • Potential information exposure through detailed error logging

2. CODEOWNERS File Security Implications

   • Reveals internal GitHub usernames and team structure
   • Potential information disclosure about project's organizational hierarchy
   • Usernames might enable social engineering or targeted attacks

3. Slack PR Reminder Workflow Security Considerations

   • Uses two secret tokens: GitHub and Slack authentication tokens
   • Explicitly checks out only master branch to reduce secret leak possibilities

4. OIDC Configuration Expansion (Changelog)

   • Potential need for careful validation of OIDC authentication settings
   • New permission assignment method requires thorough access control review

5. Potential Token and API Security Risks in PR Reminder Script

   • No explicit access control checks
   • Relies on GitHub and Slack token permissions
   • Comprehensive error handling that might leak sensitive information

View PR in the DryRun Dashboard.