django-octo-security 0.1.0__tar.gz

django_octo_security-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: CI
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  qa-pipeline:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Rye
+        uses: eifinger/setup-rye@v4
+        with:
+          enable-cache: true
+
+      - name: Synchronize dependencies (including dev-dependencies)
+        run: rye sync
+
+      - name: Run database migrations
+        env:
+          PYTHONPATH: src
+        run: rye run python manage.py migrate
+
+      - name: Execute Unit & Query-Count Suite (pytest)
+        env:
+          PYTHONPATH: src
+        run: rye run pytest
+
+      - name: Execute Behavioral Specifications (behave)
+        env:
+          PYTHONPATH: src
+        run: rye run behave
+

django_octo_security-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,29 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  pypi-publish:
+    name: Build and publish distribution to PyPI
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Rye
+        uses: eifinger/setup-rye@v4
+
+      - name: Build distribution packages
+        run: rye build
+
+      - name: Publish package to PyPI via Trusted Publisher
+        uses: pypa/gh-action-pypi-publish@release/v1
+

django_octo_security-0.1.0/.gitignore

@@ -0,0 +1,30 @@
+# python generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# ==========================================
+# Rye / Python Environment
+# ==========================================
+.venv/
+.python-version
+.project-id
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+
+# ==========================================
+# Django Local Configurations & Media
+# ==========================================
+.env
+local_settings.py
+media/
+staticfiles/
+db.sqlite3

django_octo_security-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 jeanpmodev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_octo_security-0.1.0/PKG-INFO

@@ -0,0 +1,129 @@
+Metadata-Version: 2.3
+Name: django-octo-security
+Version: 0.1.0
+Summary: Enterprise-ready Django runtime security and zero-dependency environment CVE audit module under the Django-Octo architecture.
+Project-URL: Homepage, https://github.com/jeanpmodev/django_octo_security
+Project-URL: Repository, https://github.com/jeanpmodev/django_octo_security
+Author-email: jeanpmodev <jeanpmodev@gmail.com>
+License: MIT
+License-File: LICENSE
+Keywords: audit,cve,django,hardening,osv,security,vulnerability-scanner
+Classifier: Framework :: Django
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Requires-Python: >=3.12
+Requires-Dist: django>=6.1.2
+Requires-Dist: python-dotenv
+Description-Content-Type: text/markdown
+
+# django_octo_security
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow)](LICENSE)
+[![Python](https://img.shields.io/badge/Python-3.11+-blue)](https://python.org)
+[![Framework: Django](https://img.shields.io/badge/Framework-Django-darkgreen)](https://djangoproject.com)
+[![Package Manager: Rye](https://img.shields.io/badge/Package_Manager-Rye-orange)](https://astral.sh)
+![PyPI Version](https://img.shields.io/pypi/v/django-octo-security)
+[![Latest on Django Packages](https://img.shields.io/badge/Django_Packages-django__octo__security-8c3c26.svg)](https://djangopackages.org/packages/p/django_octo_security/)
+[![Tests: pytest](https://img.shields.io/badge/Tests-pytest%20passed-2ea44f.svg)](https://github.com/jeanpmodev/django_octo_security/blob/main/TESTING.md)
+[![BDD: Behave](https://img.shields.io/badge/BDD-Behave%20verified-009688.svg)](https://github.com/jeanpmodev/django_octo_security/blob/main/TESTING.md)
+[![Load Test: Locust](https://img.shields.io/badge/Load_Test-11ms_median_%7C_0%25_fails-blueviolet.svg)](https://github.com/jeanpmodev/django_octo_security/blob/main/performance/locust_load_report.pdf)
+[![CI](https://img.shields.io/github/actions/workflow/status/jeanpmodev/django_octo_security/ci.yml?branch=main&label=CI)](https://github.com/jeanpmodev/django_octo_security/actions/workflows/ci.yml)
+[![Code Style: PEP 8](https://img.shields.io/badge/code%20style-PEP%208-blue)](https://peps.python.org/pep-0008/)
+[![PyPI Provenance](https://img.shields.io/badge/PyPI-With%20Provenance-blue?logo=pypi&logoColor=white)](https://pypi.org/project/django-octo-security/#provenance)
+
+**Enterprise-ready, non-intrusive Django runtime security posture and zero-dependency environment CVE audit module under the Django-Octo architecture.**
+
+---
+
+## Core Philosophy: Non-Intrusive Dual Access
+
+`django-octo-security` is engineered to plug into any existing Django application **without altering your host project's native logic, templates, or root routes**:
+
+1. **Public/Internal Posture Endpoint (`/security-audit/`):** Single-query database lookup (`CveAuditScan.objects.first()`) rendering enforced HTTP security headers and the latest environment vulnerability audit status.
+2. **Native Django Admin Integration (`Security > CVE Checker`):** Automatically registers a dedicated administrative module in the left sidebar of `/admin/` with one-click environment scanning (`Run CVE Environment Audit`), querying the official **OSV.dev** vulnerability database via Python standard library (`importlib.metadata` + `urllib.request`) with **zero external runtime dependencies**.
+
+---
+
+## Security & Audit Architecture
+
+| Layer | Mechanism / Target | Engineering Purpose |
+| :--- | :--- | :--- |
+| **01** | **Clickjacking Shield** | Enforces `X-Frame-Options: DENY` to prevent unauthorized iframe embedding. |
+| **02** | **MIME Sniffing Guard** | Enforces `X-Content-Type-Options: nosniff` against content-type confusion attacks. |
+| **03** | **Referrer Isolation** | Applies `Referrer-Policy: strict-origin-when-cross-origin` to prevent token leakage. |
+| **04** | **Single-Query Posture View** | Renders `/security-audit/` in a single ORM query for high-throughput scalability. |
+| **05** | **Runtime Introspection** | Reads active virtual environment packages via native `importlib.metadata`. |
+| **06** | **Batch OSV Vulnerability Query** | Cross-references all installed PyPI packages against `api.osv.dev/v1/querybatch`. |
+| **07** | **Advisory Enrichment & Fixes** | Resolves CVE aliases, patched versions, and official references per vulnerability. |
+| **08** | **Immutable Audit Persistence** | Stores historical snapshots (`CveAuditScan`) directly in the host database. |
+
+---
+
+## Plug-and-Play Installation
+
+Install the official package directly into any modern Django (`>=6.1.2`) and Python (`>=3.12`) infrastructure using **pip** or **Rye**:
+
+### 1. Clone & Synchronize Environment
+Clone the repository and trigger the Rust-backed Rye environment compiler to lock and synchronize dependencies:
+```bash
+git clone https://github.com/jeanpmodev/django_octo_security.git
+cd django_octo_security
+rye sync
+```
+
+
+### 2. Register in `settings.py`
+Add `"django_octo_security"` to your `INSTALLED_APPS`:
+```python
+INSTALLED_APPS = [
+    # ... your existing apps
+    "django_octo_security",
+]
+```
+
+### 3. Include the Audit Route in `urls.py`
+Including the module at the root preserves your host application's homepage (`/`) and mounts the posture report at `/security-audit/`:
+```python
+from django.contrib import admin
+from django.urls import include, path
+
+urlpatterns = [
+    path("admin/", admin.site.urls),
+    path("", include("django_octo_security.urls")),
+]
+```
+
+### 4. Apply Migrations
+```bash
+python3 manage.py migrate
+```
+
+
+### 5. Initialize Runtime Service
+Fire up the local development engine instance:
+```bash
+python3 manage.py runserver
+```
+Navigate to `127.0.0.1:8000/security-audit/` to inspect live.
+
+---
+
+## Usage
+
+* **Security Posture Screen:** Navigate to `http://127.0.0.1:8000/security-audit/` to inspect active HTTP security policies and the latest environment CVE audit badge.
+* **Admin CVE Checker:** Log in to `http://127.0.0.1:8000/admin/`, open **Security > CVE Checker** in the left navigation bar, and click **Run CVE Environment Audit** at the top right to scan all installed Python packages in real time.
+
+---
+
+
+## Quality Assurance & Testing
+
+This module is backed by a dedicated QA suite covering **Unit & Query-Count Tests (`pytest`)**, **BDD Specifications (`behave`)**, and **Load Testing (`locust`)**. To keep the core package minimal, test dependencies are installed on demand—see [TESTING.md](TESTING.md) for instructions and benchmark reports.
+
+
+## 📄 License & Ecosystem Blueprint
+
+Distributed under the permissive terms of the **MIT License**. 
+

django_octo_security-0.1.0/README.md

@@ -0,0 +1,109 @@
+# django_octo_security
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow)](LICENSE)
+[![Python](https://img.shields.io/badge/Python-3.11+-blue)](https://python.org)
+[![Framework: Django](https://img.shields.io/badge/Framework-Django-darkgreen)](https://djangoproject.com)
+[![Package Manager: Rye](https://img.shields.io/badge/Package_Manager-Rye-orange)](https://astral.sh)
+![PyPI Version](https://img.shields.io/pypi/v/django-octo-security)
+[![Latest on Django Packages](https://img.shields.io/badge/Django_Packages-django__octo__security-8c3c26.svg)](https://djangopackages.org/packages/p/django_octo_security/)
+[![Tests: pytest](https://img.shields.io/badge/Tests-pytest%20passed-2ea44f.svg)](https://github.com/jeanpmodev/django_octo_security/blob/main/TESTING.md)
+[![BDD: Behave](https://img.shields.io/badge/BDD-Behave%20verified-009688.svg)](https://github.com/jeanpmodev/django_octo_security/blob/main/TESTING.md)
+[![Load Test: Locust](https://img.shields.io/badge/Load_Test-11ms_median_%7C_0%25_fails-blueviolet.svg)](https://github.com/jeanpmodev/django_octo_security/blob/main/performance/locust_load_report.pdf)
+[![CI](https://img.shields.io/github/actions/workflow/status/jeanpmodev/django_octo_security/ci.yml?branch=main&label=CI)](https://github.com/jeanpmodev/django_octo_security/actions/workflows/ci.yml)
+[![Code Style: PEP 8](https://img.shields.io/badge/code%20style-PEP%208-blue)](https://peps.python.org/pep-0008/)
+[![PyPI Provenance](https://img.shields.io/badge/PyPI-With%20Provenance-blue?logo=pypi&logoColor=white)](https://pypi.org/project/django-octo-security/#provenance)
+
+**Enterprise-ready, non-intrusive Django runtime security posture and zero-dependency environment CVE audit module under the Django-Octo architecture.**
+
+---
+
+## Core Philosophy: Non-Intrusive Dual Access
+
+`django-octo-security` is engineered to plug into any existing Django application **without altering your host project's native logic, templates, or root routes**:
+
+1. **Public/Internal Posture Endpoint (`/security-audit/`):** Single-query database lookup (`CveAuditScan.objects.first()`) rendering enforced HTTP security headers and the latest environment vulnerability audit status.
+2. **Native Django Admin Integration (`Security > CVE Checker`):** Automatically registers a dedicated administrative module in the left sidebar of `/admin/` with one-click environment scanning (`Run CVE Environment Audit`), querying the official **OSV.dev** vulnerability database via Python standard library (`importlib.metadata` + `urllib.request`) with **zero external runtime dependencies**.
+
+---
+
+## Security & Audit Architecture
+
+| Layer | Mechanism / Target | Engineering Purpose |
+| :--- | :--- | :--- |
+| **01** | **Clickjacking Shield** | Enforces `X-Frame-Options: DENY` to prevent unauthorized iframe embedding. |
+| **02** | **MIME Sniffing Guard** | Enforces `X-Content-Type-Options: nosniff` against content-type confusion attacks. |
+| **03** | **Referrer Isolation** | Applies `Referrer-Policy: strict-origin-when-cross-origin` to prevent token leakage. |
+| **04** | **Single-Query Posture View** | Renders `/security-audit/` in a single ORM query for high-throughput scalability. |
+| **05** | **Runtime Introspection** | Reads active virtual environment packages via native `importlib.metadata`. |
+| **06** | **Batch OSV Vulnerability Query** | Cross-references all installed PyPI packages against `api.osv.dev/v1/querybatch`. |
+| **07** | **Advisory Enrichment & Fixes** | Resolves CVE aliases, patched versions, and official references per vulnerability. |
+| **08** | **Immutable Audit Persistence** | Stores historical snapshots (`CveAuditScan`) directly in the host database. |
+
+---
+
+## Plug-and-Play Installation
+
+Install the official package directly into any modern Django (`>=6.1.2`) and Python (`>=3.12`) infrastructure using **pip** or **Rye**:
+
+### 1. Clone & Synchronize Environment
+Clone the repository and trigger the Rust-backed Rye environment compiler to lock and synchronize dependencies:
+```bash
+git clone https://github.com/jeanpmodev/django_octo_security.git
+cd django_octo_security
+rye sync
+```
+
+
+### 2. Register in `settings.py`
+Add `"django_octo_security"` to your `INSTALLED_APPS`:
+```python
+INSTALLED_APPS = [
+    # ... your existing apps
+    "django_octo_security",
+]
+```
+
+### 3. Include the Audit Route in `urls.py`
+Including the module at the root preserves your host application's homepage (`/`) and mounts the posture report at `/security-audit/`:
+```python
+from django.contrib import admin
+from django.urls import include, path
+
+urlpatterns = [
+    path("admin/", admin.site.urls),
+    path("", include("django_octo_security.urls")),
+]
+```
+
+### 4. Apply Migrations
+```bash
+python3 manage.py migrate
+```
+
+
+### 5. Initialize Runtime Service
+Fire up the local development engine instance:
+```bash
+python3 manage.py runserver
+```
+Navigate to `127.0.0.1:8000/security-audit/` to inspect live.
+
+---
+
+## Usage
+
+* **Security Posture Screen:** Navigate to `http://127.0.0.1:8000/security-audit/` to inspect active HTTP security policies and the latest environment CVE audit badge.
+* **Admin CVE Checker:** Log in to `http://127.0.0.1:8000/admin/`, open **Security > CVE Checker** in the left navigation bar, and click **Run CVE Environment Audit** at the top right to scan all installed Python packages in real time.
+
+---
+
+
+## Quality Assurance & Testing
+
+This module is backed by a dedicated QA suite covering **Unit & Query-Count Tests (`pytest`)**, **BDD Specifications (`behave`)**, and **Load Testing (`locust`)**. To keep the core package minimal, test dependencies are installed on demand—see [TESTING.md](TESTING.md) for instructions and benchmark reports.
+
+
+## 📄 License & Ecosystem Blueprint
+
+Distributed under the permissive terms of the **MIT License**. 
+

django_octo_security-0.1.0/TESTING.md

@@ -0,0 +1,50 @@
+#  Quality Assurance & Testing Methodology
+
+[![Tests: pytest](https://img.shields.io/badge/Tests-pytest%20passed-2ea44f.svg)](#2-unit--query-count-validation-pytest)
+[![BDD: Behave](https://img.shields.io/badge/BDD-Behave%20verified-009688.svg)](#3-behavioral--bdd-specifications-behave)
+[![Load Test: Locust](https://img.shields.io/badge/Load_Test-11ms_median_%7C_0%25_fails-blueviolet.svg)](performance/locust_load_report.pdf)
+
+---
+
+## 1. On-Demand QA Setup
+Inside an isolated virtual environment, install the validation stack:
+```bash
+rye add pytest pytest-django behave locust
+```
+
+---
+
+## 2. Unit & Query-Count Validation (`pytest`)
+Verifies schema migrations, OSV API vulnerability batch parsing, advisory enrichment, and enforces the **Single Database Lookup (`assertNumQueries(1)`)** contract on `/security-audit/`:
+```bash
+PYTHONPATH=src rye run pytest
+```
+
+---
+
+## 3. Behavioral / BDD Specifications (`behave`)
+Executes Gherkin scenarios (`features/security_audit.feature`) validating the runtime posture endpoint and CVE environment audit scanner end-to-end:
+```bash
+PYTHONPATH=src rye run behave
+```
+
+---
+
+## 4. Load & Concurrency Stress Benchmark (`locust`)
+Simulates concurrent requests hitting the live `/security-audit/` posture endpoint to verify zero-error stability under load:
+
+```bash
+# Terminal 1: Start runtime service
+rye run python3 manage.py runserver --noreload
+
+# Terminal 2: Execute headless load benchmark
+rye run locust -f performance/locustfile.py --headless -u 20 -r 5 -t 10s --host http://127.0.0.1:8000
+```
+
+### Benchmark Summary
+* **Failure Rate:** `0.00%` (HTTP 200 OK across all posture audit requests)
+* **Query Overhead:** Strict `1 query` per request (`CveAuditScan.objects.first()`)
+* **Detailed Metrics:** Available in the exported report below.
+
+ **[View Official Locust Load Test Report (PDF)](performance/locust_load_report.pdf)**
+

django_octo_security-0.1.0/audits/AUDITS.md

@@ -0,0 +1,3 @@
+# Security & CVE Audit Reports
+
+This directory stores formal security posture benchmarks, HTTP header validations, and OSV CVE environment audit snapshots for **django_octo_security**.

django_octo_security-0.1.0/config/asgi.py

@@ -0,0 +1,16 @@
+"""
+ASGI config for config project.
+
+It exposes the ASGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/6.1/howto/deployment/asgi/
+"""
+
+import os
+
+from django.core.asgi import get_asgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.settings")
+
+application = get_asgi_application()

django_octo_security-0.1.0/config/settings.py

@@ -0,0 +1,135 @@
+"""
+Django settings for config project.
+
+Generated by 'django-admin startproject' using Django 6.1.2.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/6.1/topics/settings/
+
+For the full list of settings and their values, see
+https://docs.djangoproject.com/en/6.1/ref/settings/
+"""
+
+import os
+from pathlib import Path
+from dotenv import load_dotenv
+
+# 1. First, build paths inside the project like this: BASE_DIR / 'subdir'.
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+# 2. Then, load environment variables from the .env file using BASE_DIR
+load_dotenv(BASE_DIR / ".env")
+
+# Quick-start development settings - unsuitable for production
+# See https://docs.djangoproject.com/en/6.1/howto/deployment/checklist/
+
+# SECURITY WARNING: keep the secret key used in production secret!
+SECRET_KEY = os.getenv(
+    "SECRET_KEY", "django-insecure-production-fallback-key-change-in-env"
+)
+
+# SECURITY WARNING: don't run with debug turned on in production!
+DEBUG = True
+
+ALLOWED_HOSTS = []
+
+
+# Application definition
+
+INSTALLED_APPS = [
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    "django_octo_security",
+]
+
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+]
+
+ROOT_URLCONF = "config.urls"
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [BASE_DIR / "templates"],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.debug",
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = "config.wsgi.application"
+
+
+# Database
+# https://docs.djangoproject.com/en/6.1/ref/settings/#databases
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.sqlite3",
+        "NAME": BASE_DIR / "db.sqlite3",
+    }
+}
+
+
+# Password validation
+# https://docs.djangoproject.com/en/6.1/ref/settings/#auth-password-validators
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
+    },
+]
+
+
+# Internationalization
+# https://docs.djangoproject.com/en/6.1/topics/i18n/
+
+LANGUAGE_CODE = "en-us"
+
+TIME_ZONE = "UTC"
+
+USE_I18N = True
+
+USE_TZ = True
+
+
+# Static files (CSS, JavaScript, Images)
+# https://docs.djangoproject.com/en/6.1/howto/static-files/
+
+STATIC_URL = "static/"
+
+
+# Email
+# https://docs.djangoproject.com/en/6.1/topics/email/#topic-email-configuration
+
+MAILERS = {
+    "default": {
+        "BACKEND": "django.core.mail.backends.console.EmailBackend",
+    },
+}

django_octo_security-0.1.0/config/urls.py

@@ -0,0 +1,24 @@
+"""
+URL configuration for config project.
+
+The `urlpatterns` list routes URLs to views. For more information please see:
+    https://docs.djangoproject.com/en/6.1/topics/http/urls/
+Examples:
+Function views
+    1. Add an import:  from my_app import views
+    2. Add a URL to urlpatterns:  path('', views.home, name='home')
+Class-based views
+    1. Add an import:  from other_app.views import Home
+    2. Add a URL to urlpatterns:  path('', Home.as_view(), name='home')
+Including another URLconf
+    1. Import the include() function: from django.urls import include, path
+    2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
+"""
+
+from django.contrib import admin
+from django.urls import path, include
+
+urlpatterns = [
+    path("admin/", admin.site.urls),
+    path("", include("django_octo_security.urls")),
+]

django_octo_security-0.1.0/config/wsgi.py

@@ -0,0 +1,16 @@
+"""
+WSGI config for config project.
+
+It exposes the WSGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/6.1/howto/deployment/wsgi/
+"""
+
+import os
+
+from django.core.wsgi import get_wsgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.settings")
+
+application = get_wsgi_application()

django_octo_security-0.1.0/features/environment.py

@@ -0,0 +1,19 @@
+import os
+import django
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "tests.settings")
+django.setup()
+
+
+def before_all(context):
+    from django.test.utils import setup_test_environment, setup_databases
+
+    setup_test_environment()
+    context.old_config = setup_databases(verbosity=0, interactive=False)
+
+
+def after_all(context):
+    from django.test.utils import teardown_databases, teardown_test_environment
+
+    teardown_databases(context.old_config, verbosity=0)
+    teardown_test_environment()

django_octo_security-0.1.0/features/security_audit.feature

@@ -0,0 +1,16 @@
+Feature: Django-Octo Security Runtime and CVE Audit
+  As a system administrator
+  I want to verify security headers and audit installed Python packages for CVEs
+  So that the application maintains high security compliance without impacting runtime performance
+
+  Scenario: Render security audit endpoint with single query
+    Given the database has a clean CVE audit scan recorded
+    When a client requests the "/security-audit/" endpoint
+    Then the response status code should be 200
+    And the security showcase page should display "CLEAN"
+
+  Scenario: Detect vulnerabilities in installed packages via OSV scanner
+    Given the environment has a vulnerable package "django" at version "6.1.0"
+    When the CVE environment audit scanner executes
+    Then the audit status should be "VULNERABLE"
+    And the audit report should contain "PYSEC-2026-001"