ci(security): add security-focused CI/CD workflow#2039
Conversation
Add a dedicated security CI/CD pipeline that runs on push/PR to main. Catches the classes of vulnerabilities identified in issues utksh1#2035 and utksh1#2036: - Bandit Python security linting (high-severity gate) - Route authentication protection checks - Debug mode default validation - Hardcoded secret detection - Environment configuration validation - Dependency vulnerability auditing This provides continuous security regression testing to prevent similar vulnerabilities from being introduced in future PRs.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 817de28d4f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if re.search(r'debug\s*[=:]\s*True', line) and 'if' not in line and '#' not in line.split('debug')[0]: | ||
| issues.append(f'{py_file}:{i}: debug defaults to True') | ||
| # Check for traceback.format_exc in responses | ||
| if 'traceback.format_exc' in line and 'settings.debug' not in content.split(line)[max(0, content.split(line)[0].rfind('if')):]: |
There was a problem hiding this comment.
In the current tree the exception handler in backend/secuscan/main.py has if settings.debug: immediately above traceback.format_exc(), but this expression slices the list returned by content.split(line) instead of checking the nearby source text, so it evaluates as if the guard is missing and exits 1 on every run. This makes the new workflow fail even for tracebacks that are correctly guarded by debug mode.
Useful? React with 👍 / 👎.
|
|
||
| # Patterns that indicate hardcoded secrets | ||
| patterns = [ | ||
| (r'password\s*=\s*[\"'][^\"']+[\"']', 'Hardcoded password'), |
There was a problem hiding this comment.
When this workflow reaches secret-scan, Python parses this raw single-quoted regex and the unescaped ' inside [\"'] closes the string, so the inline script raises a SyntaxError before scanning. The same quoting pattern is repeated on the following regexes, which makes the new security job fail on every push/PR rather than reporting hardcoded secrets.
Useful? React with 👍 / 👎.
Fix two issues flagged by the bot review: 1. Debug guard check: The original logic used content.split(line) which incorrectly sliced strings. Replace with proper backward scan that checks the 10 lines above traceback.format_exc for an if-settings.debug guard. 2. Secret scan regex: Replace character class quoting with hex-escaped patterns to avoid YAML/Python shell quoting conflicts that caused SyntaxError. Also simplify the POSTGRES_PASSWORD pattern. All f-string interpolations replaced with .format() to avoid nested quote escaping issues in YAML run blocks.
utksh1
left a comment
utksh1
left a comment
There was a problem hiding this comment.
Excellent security CI workflow! This adds automated regression prevention for auth bypass, debug exposure, hardcoded secrets, and dependency vulnerabilities.
The Bandit HIGH severity findings (SHA1 usage in finding_intelligence.py:75 and platform_resources.py:29) are pre-existing issues in main, not introduced by this PR. These should be fixed by adding usedforsecurity=False parameter since they're used for ID generation, not cryptographic security.
The backend-unit test failures were already fixed by #2040 and #2041. Once CI re-runs on the updated branch, those should pass.
Merging this workflow so we have automated security checks going forward. The SHA1 findings can be addressed in a follow-up PR.
utksh1
added
type:devops
2 participants
Summary
Add a dedicated security CI/CD pipeline that runs on every push/PR to
main, preventing regression of the vulnerability classes found in issues #2035 and #2036.What this workflow checks
APIRouter()definitions inbackend/secuscan/and warns if any lackdependencies=[Depends(require_api_key)]— prevents auth bypass regressions like #2035.debugdoesn't default toTrueand that tracebacks aren't exposed without debug guards — prevents info disclosure regressions like #2036..env.examplehas safe defaults (debug=false, no placeholder secrets).pip-auditagainstbackend/requirements.txtto catch known CVEs in dependencies.Why this matters
The two critical vulnerabilities found (#2035 auth bypass, #2036 debug exposure) were both configuration-level issues that could easily be reintroduced. This workflow provides automated regression prevention for:
Labels
type:devops,level:advanced,priority:high