argus-appsec 0.1.0__tar.gz

argus_appsec-0.1.0/.dockerignore

@@ -0,0 +1,21 @@
+.git
+.github
+.venv
+venv
+env
+__pycache__
+*.pyc
+.pytest_cache
+.mypy_cache
+.ruff_cache
+.coverage
+htmlcov
+dist
+build
+*.egg-info
+examples/reports
+docs
+tests
+.env
+.env.*
+!.env.example

argus_appsec-0.1.0/.env.example

@@ -0,0 +1,15 @@
+# Copy to .env and fill in the providers you intend to use.
+# Argus runs without any of these using the built-in heuristic provider.
+
+# --- Cloud AI providers ---
+ANTHROPIC_API_KEY=
+OPENAI_API_KEY=
+
+# --- Local AI provider (Ollama) ---
+# Default endpoint; change if Ollama runs elsewhere.
+OLLAMA_HOST=http://localhost:11434
+
+# --- Git hosting integrations (for remote targets / PR creation) ---
+GITHUB_TOKEN=
+GITLAB_TOKEN=
+BITBUCKET_TOKEN=

argus_appsec-0.1.0/.gitattributes

@@ -0,0 +1,9 @@
+# Normalize line endings: text files use LF in the repository.
+* text=auto eol=lf
+
+# Binary/asset types git should not touch.
+*.png binary
+*.jpg binary
+*.gif binary
+*.ico binary
+*.pdf binary

argus_appsec-0.1.0/.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# Code owners are automatically requested for review on pull requests.
+# The owner reviews and merges everything by default. Add more owners for
+# specific paths as the project grows, e.g.:
+#   /src/argus/scanners/  @some-trusted-contributor
+#
+# Reference: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+* @hasipfaruk

argus_appsec-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,58 @@
+name: Bug report
+description: Report something that isn't working as expected in Argus.
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug. Please fill in the sections below.
+        For a security vulnerability *in Argus itself*, do not open a public issue —
+        see SECURITY.md.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear description of the bug, and what you expected instead.
+      placeholder: When I run `argus scan ...`, I expected X but got Y.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: The exact command(s) and, if possible, a minimal example.
+      placeholder: |
+        1. argus scan ./my-project -s secrets
+        2. ...
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Output / error
+      description: Paste the relevant output. This is automatically formatted as code.
+      render: shell
+  - type: input
+    id: version
+    attributes:
+      label: Argus version
+      description: Output of `argus version`.
+      placeholder: Argus v0.1.0
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: python
+    attributes:
+      label: Python version
+      placeholder: "3.11"

argus_appsec-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability in Argus (private)
+    url: https://github.com/hasipfaruk/Argus/security/advisories/new
+    about: Please report security issues privately, not as a public issue. See SECURITY.md.
+  - name: Questions & discussion
+    url: https://github.com/hasipfaruk/Argus/discussions
+    about: Ask questions and discuss ideas here (enable Discussions in repo settings).

argus_appsec-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,38 @@
+name: Feature request
+description: Suggest a new scanner, rule, report format, or capability.
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: Describe the use case or the gap you're hitting.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What you'd like Argus to do. If it's a new scanner/rule, note the
+        language and the vulnerability class (and a CWE if you know it).
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - New scanner or rule
+        - New language support
+        - New report format
+        - AI provider
+        - CLI / usability
+        - Fix / pull-request workflow
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches you thought about, or how you work around this today.

argus_appsec-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+<!-- Thanks for contributing to Argus! Fill this in so review is quick. -->
+
+## What does this change?
+
+<!-- A short description of the change and why it's needed. Link any related issue. -->
+
+Closes #
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New scanner / rule
+- [ ] New reporter or AI provider
+- [ ] Documentation
+- [ ] Other (describe below)
+
+## Checklist
+
+- [ ] I ran `pytest` and all tests pass
+- [ ] I ran `ruff check .` with no errors
+- [ ] I added or updated tests for my change
+- [ ] I updated docs if behavior or usage changed
+- [ ] New findings (if any) include a CWE/OWASP mapping and remediation
+
+## Notes for the reviewer
+
+<!-- Anything that will help review: trade-offs, things you're unsure about, etc. -->

argus_appsec-0.1.0/.github/workflows/argus-scan.yml

@@ -0,0 +1,45 @@
+# Example: run Argus on every push/PR and upload results to GitHub Code Scanning.
+#
+# Copy this into your own repository's .github/workflows/ to get Argus findings
+# as annotations on pull requests and in the Security tab. The SARIF upload maps
+# Argus severities onto GitHub's alert levels.
+name: Argus Security Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+  security-events: write   # required to upload SARIF
+
+jobs:
+  argus:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install Argus
+        # This repo installs Argus from its own source. In your own project,
+        # replace this with `pip install argus-appsec` once Argus is on PyPI.
+        run: pip install .
+
+      - name: Run Argus
+        # Do not fail the job here; let the SARIF upload surface findings.
+        # Set --fail-on high to block merges on High+ instead.
+        run: argus scan src -f sarif -o argus.sarif --quiet
+        env:
+          # Optional: use a cloud model for richer analysis. Omit to run offline.
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+
+      - name: Upload SARIF to Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: argus.sarif
+          category: argus

argus_appsec-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install
+        run: pip install -e ".[dev]"
+
+      - name: Lint
+        run: ruff check .
+
+      - name: Type check
+        run: mypy || true   # advisory during alpha
+
+      - name: Test
+        run: pytest -q --cov=argus --cov-report=term-missing
+
+  build-image:
+    name: Build Docker image
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build
+        run: docker build -t argus:ci .
+      - name: Smoke test the image
+        run: docker run --rm -v "$PWD/examples/vulnerable-app:/work" argus:ci scan /work --min-severity high

argus_appsec-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,48 @@
+# Publish Argus to PyPI when a GitHub Release is published.
+#
+# Uses PyPI Trusted Publishing (OIDC) — no API token or secret is stored in the
+# repo. You configure the trust relationship once on PyPI (see RELEASING.md).
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build distributions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist and wheel
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+          python -m twine check dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/argus-appsec/
+    permissions:
+      id-token: write   # required for trusted publishing (OIDC)
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1

argus_appsec-0.1.0/.gitignore

@@ -0,0 +1,34 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+.venv/
+venv/
+env/
+
+# Tooling
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+coverage.xml
+
+# Argus output
+.argus/
+argus-report.*
+*.sarif
+
+# Environment / secrets
+.env
+.env.*
+!.env.example
+
+# Editors / OS
+.idea/
+.vscode/
+.DS_Store
+Thumbs.db

argus_appsec-0.1.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,42 @@
+# Contributor Code of Conduct
+
+## Our pledge
+
+We as members, contributors, and maintainers pledge to make participation in the
+Argus community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Our standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Being respectful of differing opinions, viewpoints, and experiences.
+- Giving and gracefully accepting constructive feedback.
+- Focusing on what is best for the community and the project.
+- Showing empathy toward other community members.
+
+Examples of unacceptable behavior:
+
+- Harassment, insults, or derogatory comments, and personal or political attacks.
+- Publishing others' private information without explicit permission.
+- Trolling or deliberately disruptive behavior.
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the project maintainer. All complaints will be reviewed and
+investigated promptly and fairly. The maintainer is obligated to respect the
+privacy and security of the reporter of any incident.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
+
+[homepage]: https://www.contributor-covenant.org

argus_appsec-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,67 @@
+# Contributing to Argus
+
+Thanks for considering a contribution. Argus is designed so that most
+additions — new scanners, languages, compliance rules, report formats — land as
+plugins and never touch the core. That keeps the barrier low and the core stable.
+
+## Getting set up
+
+```bash
+git clone https://github.com/hasipfaruk/Argus
+cd argus
+python -m venv .venv && . .venv/bin/activate   # Windows: .venv\Scripts\activate
+pip install -e ".[dev]"
+```
+
+Run the checks:
+
+```bash
+pytest              # tests
+ruff check .        # lint
+mypy                # type check (advisory during alpha)
+```
+
+All three run in CI on every pull request; please make sure they pass locally
+first.
+
+## What makes a good contribution
+
+- **New scanners and rules.** The highest-value contributions. See
+  [docs/plugins.md](docs/plugins.md). New rules for the built-in `patterns` and
+  `iac` scanners are just entries in a list.
+- **Language support.** Extend `argus/analysis/languages.py` and add
+  language-specific rules or a dedicated scanner.
+- **Report formats.** Subclass `Reporter`.
+- **AI providers.** Wrap another model backend behind `AIProvider`.
+
+## Standards
+
+- **Tests are required** for new behavior. Put fixtures in `tests/conftest.py` and
+  keep tests deterministic — the default offline provider makes this easy.
+- **Every finding must carry a CWE and OWASP mapping** and, ideally, the reasoning
+  fields so it is useful without a model.
+- **Keep the core dependency-light.** New heavy dependencies belong behind an
+  optional extra (`pip install argus-appsec[...]`), like the cloud providers.
+- **Match the house style.** Ruff enforces formatting and imports; follow the
+  patterns in the existing scanners.
+
+## Security rules of the road
+
+Argus is a security tool; contributions should reflect that.
+
+- The Attack Simulation feature is **educational and non-executing** by design. Do
+  not add anything that runs generated exploits or sends traffic to live targets
+  without an explicit, opt-in, sandboxed design discussed in an issue first.
+- If you find a vulnerability *in Argus itself*, please report it privately (see
+  [SECURITY.md](SECURITY.md)) rather than opening a public issue.
+
+## Pull request process
+
+1. Open an issue for anything non-trivial so we can agree on the approach.
+2. Branch from `main`, keep the change focused.
+3. Add tests and docs.
+4. Ensure `pytest`, `ruff check .`, and `mypy` pass.
+5. Describe the change and its motivation in the PR.
+
+By contributing you agree that your contributions are licensed under the project's
+Apache-2.0 license.

argus_appsec-0.1.0/Dockerfile

@@ -0,0 +1,36 @@
+# Argus container image.
+#
+# Multi-stage build: install into a venv in the builder, copy the venv into a
+# slim runtime. Includes git so remote repository targets can be cloned.
+FROM python:3.12-slim AS builder
+
+ENV PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+WORKDIR /src
+COPY pyproject.toml README.md ./
+COPY src ./src
+
+RUN python -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+RUN pip install .
+
+# --- runtime ---------------------------------------------------------------
+FROM python:3.12-slim AS runtime
+
+# git is needed to scan remote repositories.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /opt/venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# Run as a non-root user.
+RUN useradd --create-home --uid 10001 argus
+USER argus
+WORKDIR /work
+
+# Mount the project to scan at /work.
+ENTRYPOINT ["argus"]
+CMD ["--help"]

argus_appsec-0.1.0/LICENSE

@@ -0,0 +1,19 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   Copyright 2026 Argus contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   The full text of the Apache License 2.0 is available at the URL above.

argus_appsec-0.1.0/Makefile

@@ -0,0 +1,29 @@
+# Developer convenience targets. See CONTRIBUTING.md.
+.PHONY: install test lint typecheck fmt scan-example docker clean
+
+install:
+	pip install -e ".[dev]"
+
+test:
+	pytest -q
+
+lint:
+	ruff check .
+
+typecheck:
+	mypy
+
+fmt:
+	ruff check . --fix
+
+# Run a full scan on the bundled vulnerable example with all features on.
+scan-example:
+	argus scan examples/vulnerable-app --attack-sim --patches
+
+docker:
+	docker build -t argus:local .
+
+clean:
+	rm -rf .pytest_cache .ruff_cache .mypy_cache htmlcov .coverage \
+		dist build src/*.egg-info examples/reports
+	find . -type d -name __pycache__ -prune -exec rm -rf {} +