sec-report-kit 0.3.4__tar.gz → 0.4.4__tar.gz

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/.github/workflows/pip-audit.yml

@@ -17,8 +17,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
 
       - uses: actions/setup-python@v5
         with:

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/.github/workflows/publish-pypi.yml

@@ -14,8 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
 
       - uses: actions/setup-python@v5
         with:
@@ -49,8 +47,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
 
       - uses: actions/setup-python@v5
         with:
@@ -68,12 +64,11 @@ jobs:
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
+      contents: read    # required for checkout on private repos
       id-token: write   # required for OIDC trusted publishing
 
     steps:
       - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
 
       - uses: actions/setup-python@v5
         with:

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/.github/workflows/publish-testpypi.yml

@@ -14,8 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
 
       - uses: actions/setup-python@v5
         with:
@@ -33,12 +31,11 @@ jobs:
     runs-on: ubuntu-latest
     environment: testpypi
     permissions:
+      contents: read    # required for checkout on private repos
       id-token: write   # required for OIDC trusted publishing
 
     steps:
       - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
 
       - uses: actions/setup-python@v5
         with:

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/.github/workflows/trivy-fs-audit.yml

@@ -17,8 +17,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
 
       - name: Run Trivy filesystem scan
         uses: aquasecurity/trivy-action@v0.36.0

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/.github/workflows/unit-test-coverage-gate.yml

@@ -15,8 +15,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
 
       - uses: actions/setup-python@v5
         with:
@@ -36,8 +34,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
 
       - uses: actions/setup-python@v5
         with:

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 All notable changes to this project are documented in this file.
 
+## 0.4.4 - 2026-07-12
+
+### Fixed
+- Added `contents: read` to the PyPI/TestPyPI publish jobs. A job-level `permissions` block replaces the workflow default instead of merging, so declaring only `id-token: write` left `contents: none`, breaking checkout on the private repo. Trusted publishing (OIDC) is unaffected.
+
+## 0.4.3 - 2026-07-12
+
+### Fixed
+- Removed the invalid `REPO_ACCESS_TOKEN` checkout override from all GitHub Actions workflows so they authenticate with the default `GITHUB_TOKEN`, fixing the "Repository not found" failures in the PyPI/TestPyPI publish pipelines.
+
+## 0.4.2 - 2026-07-12
+
+### Tests
+- Added test coverage for the CycloneDX parser, SBOM HTML renderer, and `srk render sbom` command, restoring the enforced 100% suite coverage gate.
+
+## 0.4.1 - 2026-07-12
+
+### Fixed
+- Bumped `requirements.txt` pins to clear 13 fixable CRITICAL/HIGH/MEDIUM findings from the Trivy filesystem audit: `PyJWT` 2.12.1→2.13.0, `cryptography` 47.0.0→48.0.1, `idna` 3.13→3.15, `msgpack` 1.1.2→1.2.1, `pydantic-settings` 2.14.0→2.14.2, `python-multipart` 0.0.27→0.0.30, and `starlette` 1.0.0→1.3.1.
+
+## 0.4.0 - 2026-07-12
+
+### Added
+- New CLI command: `srk render sbom` to render a CycloneDX SBOM JSON into an HTML component inventory report.
+- New `Component` and `SbomDocument` models for representing SBOM component inventories.
+- New CycloneDX parser (`parsers/cyclonedx.py`) handling `license.id`, `license.name`, and `expression` license shapes, with purl-derived ecosystem detection.
+- New SBOM HTML renderer (`report/sbom_renderer.py`) with summary cards, component-type/ecosystem/license breakdowns, and a client-side filterable component table.
+
+## 0.3.5 - 2026-05-21
+
+### Added
+- Added `--source` support across all `srk render <tool>` commands so report header labels can be fully caller-defined.
+- Added optional `source_name` positional argument to all `scripts/render_*_html.(sh|bat)` helpers.
+
+### Changed
+- Updated render helper scripts to forward both source and target labels to the HTML renderer.
+- Updated README examples and helper-script documentation to include source/target customization.
+
+### Fixed
+- Preserved backward compatibility in consolidated helper scripts when the third argument is an option flag (for example `--modified-since`).
+
 ## 0.3.3 - 2026-05-21
 
 ### Added

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sec-report-kit
-Version: 0.3.4
+Version: 0.4.4
 Summary: Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON
 Author: Ravi Konduru
 License: MIT
@@ -67,25 +67,25 @@ Both commands are available:
 Render Trivy JSON:
 
 ```bash
-srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/report-trivy.html --target shankonduru/cpkc-poc:v1.0.21
+srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/report-trivy.html --source trivy --target shankonduru/cpkc-poc:v1.0.21
 ```
 
 Render pip-audit JSON:
 
 ```bash
-srk render pip-audit --input pip-audit.json --output security_reports/report-pip-audit.html --target requirements.txt
+srk render pip-audit --input pip-audit.json --output security_reports/report-pip-audit.html --source pip-audit --target requirements.txt
 ```
 
 Render Safety JSON:
 
 ```bash
-srk render safety --input security_reports/safety.json --output security_reports/report-safety.html --target requirements.txt
+srk render safety --input security_reports/safety.json --output security_reports/report-safety.html --source safety --target requirements.txt
 ```
 
 Render a consolidated HTML report from all supported scanner files in a directory:
 
 ```bash
-srk render consolidated --input security_reports --output security_reports --target sec-report-kit
+srk render consolidated --input security_reports --output security_reports --source consolidated --target sec-report-kit
 ```
 
 This command writes `consolidated-security-report.html` to the output folder.
@@ -95,14 +95,16 @@ The consolidated renderer reads raw JSON/SARIF inputs, generates the per-tool HT
 Example with implicit output folder:
 
 ```bash
-srk render consolidated --input security_reports --target sec-report-kit
+srk render consolidated --input security_reports --source consolidated --target sec-report-kit
 ```
 
+All render commands accept both `--source` and `--target` so callers can control the header values shown as `Source:` and `Target:` in generated HTML.
+
 ## Helper Scripts (bat/sh)
 
 Cross-platform helper scripts are available in `scripts/`.
 
-When render helpers are called without an explicit `<target_name>`, they automatically use the repository root folder name as the report target label.
+When render helpers are called without an explicit `<target_name>`, they automatically use the repository root folder name as the report target label. If `<source_name>` is omitted, each helper uses its tool name (for example `trivy`, `gitleaks`, `consolidated`).
 
 Install this package and Python-installable scanners:
 
@@ -181,7 +183,7 @@ scripts\run_safety.bat security_reports requirements.txt
 > download the vulnerability DB while online and cache it locally:
 >
 > ```bash
-> # Linux/macOS — download once, reuse offline
+When render helpers are called without an explicit `<target_name>`, they automatically use the repository root folder name as the report target label. If `<source_name>` is omitted, each helper uses its tool name (for example `trivy`, `gitleaks`, `consolidated`).
 > bash scripts/download_safety_db.sh
 >
 > # Windows
@@ -213,25 +215,29 @@ scripts\run_bandit.bat security_reports src
 Convert pip-audit JSON report to HTML:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> <source_name>)
 bash scripts/render_pip_audit_html.sh
 bash scripts/render_pip_audit_html.sh reports requirements.txt
+bash scripts/render_pip_audit_html.sh reports requirements.txt sbom-scan
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> <source_name>)
 scripts\render_pip_audit_html.bat
 scripts\render_pip_audit_html.bat reports requirements.txt
+scripts\render_pip_audit_html.bat reports requirements.txt sbom-scan
 ```
 
 Convert Safety JSON report to HTML:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> <source_name>)
 bash scripts/render_safety_html.sh
 bash scripts/render_safety_html.sh security_reports requirements.txt
+bash scripts/render_safety_html.sh security_reports requirements.txt safety-db
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> <source_name>)
 scripts\render_safety_html.bat
 scripts\render_safety_html.bat security_reports requirements.txt
+scripts\render_safety_html.bat security_reports requirements.txt safety-db
 ```
 
 These render helpers generate the HTML file and open it automatically in your default browser.
@@ -239,27 +245,33 @@ These render helpers generate the HTML file and open it automatically in your de
 Convert sample Trivy JSON report to HTML:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> <source_name>)
 bash scripts/render_trivy_html.sh
 bash scripts/render_trivy_html.sh security_reports my-image
+bash scripts/render_trivy_html.sh security_reports my-image image-scan
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> <source_name>)
 scripts\render_trivy_html.bat
 scripts\render_trivy_html.bat security_reports my-image
+scripts\render_trivy_html.bat security_reports my-image image-scan
 ```
 
 Convert all supported scanner reports in a folder to one consolidated HTML report:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> [source_name])
 bash scripts/render_consolidated_html.sh
 bash scripts/render_consolidated_html.sh security_reports sec-report-kit
+bash scripts/render_consolidated_html.sh security_reports sec-report-kit consolidated-dashboard
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> [source_name])
 scripts\render_consolidated_html.bat
 scripts\render_consolidated_html.bat security_reports sec-report-kit
+scripts\render_consolidated_html.bat security_reports sec-report-kit consolidated-dashboard
 ```
 
+For consolidated scripts, when the 3rd argument starts with `--`, it is treated as an extra CLI option (for backward compatibility with existing `--modified-since` usage).
+
 You can also restrict which report files are picked up by modification time and cap how many of the newest files are included:
 
 ```bash
@@ -293,25 +305,29 @@ scripts\render_consolidated_html.bat security_reports sec-report-kit --modified-
 Convert sample Bandit JSON report to HTML:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> <source_name>)
 bash scripts/render_bandit_html.sh
 bash scripts/render_bandit_html.sh security_reports my-python-project
+bash scripts/render_bandit_html.sh security_reports my-python-project python-sast
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> <source_name>)
 scripts\render_bandit_html.bat
 scripts\render_bandit_html.bat security_reports my-python-project
+scripts\render_bandit_html.bat security_reports my-python-project python-sast
 ```
 
 Convert sample Gitleaks JSON report to HTML:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> <source_name>)
 bash scripts/render_gitleaks_html.sh
 bash scripts/render_gitleaks_html.sh security_reports my-repository
+bash scripts/render_gitleaks_html.sh security_reports my-repository secret-scan
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> <source_name>)
 scripts\render_gitleaks_html.bat
 scripts\render_gitleaks_html.bat security_reports my-repository
+scripts\render_gitleaks_html.bat security_reports my-repository secret-scan
 ```
 
 By default, JSON is written to `reports/pip-audit.json` and HTML to `reports/pip-audit-report.html`.
@@ -399,16 +415,16 @@ scripts\render_gitleaks_html.bat security_reports my-repository
 Manual CLI render examples:
 
 ```bash
-srk render semgrep --input security_reports/semgrep.json --output security_reports/semgrep-report.html --target my-repo
-srk render codeql --input security_reports/codeql.sarif.json --output security_reports/codeql-report.html --target my-repo
-srk render osv-scanner --input security_reports/osv-scanner.json --output security_reports/osv-scanner-report.html --target requirements.txt
-srk render safety --input security_reports/safety.json --output security_reports/safety-report.html --target requirements.txt
-srk render checkov --input security_reports/checkov.json --output security_reports/checkov-report.html --target terraform
-srk render tfsec --input security_reports/tfsec.json --output security_reports/tfsec-report.html --target terraform
-srk render trufflehog --input security_reports/trufflehog.json --output security_reports/trufflehog-report.html --target my-repo
-srk render bandit --input security_reports/bandit.json --output security_reports/bandit-report.html --target my-python-project
-srk render gitleaks --input security_reports/gitleaks.json --output security_reports/gitleaks-report.html --target my-repository
-srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/trivy-report.html --target my-image
+srk render semgrep --input security_reports/semgrep.json --output security_reports/semgrep-report.html --source semgrep --target my-repo
+srk render codeql --input security_reports/codeql.sarif.json --output security_reports/codeql-report.html --source codeql --target my-repo
+srk render osv-scanner --input security_reports/osv-scanner.json --output security_reports/osv-scanner-report.html --source osv-scanner --target requirements.txt
+srk render safety --input security_reports/safety.json --output security_reports/safety-report.html --source safety --target requirements.txt
+srk render checkov --input security_reports/checkov.json --output security_reports/checkov-report.html --source checkov --target terraform
+srk render tfsec --input security_reports/tfsec.json --output security_reports/tfsec-report.html --source tfsec --target terraform
+srk render trufflehog --input security_reports/trufflehog.json --output security_reports/trufflehog-report.html --source trufflehog --target my-repo
+srk render bandit --input security_reports/bandit.json --output security_reports/bandit-report.html --source bandit --target my-python-project
+srk render gitleaks --input security_reports/gitleaks.json --output security_reports/gitleaks-report.html --source gitleaks --target my-repository
+srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/trivy-report.html --source trivy --target my-image
 ```
 
 ## MCP Server

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/README.md

@@ -40,25 +40,25 @@ Both commands are available:
 Render Trivy JSON:
 
 ```bash
-srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/report-trivy.html --target shankonduru/cpkc-poc:v1.0.21
+srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/report-trivy.html --source trivy --target shankonduru/cpkc-poc:v1.0.21
 ```
 
 Render pip-audit JSON:
 
 ```bash
-srk render pip-audit --input pip-audit.json --output security_reports/report-pip-audit.html --target requirements.txt
+srk render pip-audit --input pip-audit.json --output security_reports/report-pip-audit.html --source pip-audit --target requirements.txt
 ```
 
 Render Safety JSON:
 
 ```bash
-srk render safety --input security_reports/safety.json --output security_reports/report-safety.html --target requirements.txt
+srk render safety --input security_reports/safety.json --output security_reports/report-safety.html --source safety --target requirements.txt
 ```
 
 Render a consolidated HTML report from all supported scanner files in a directory:
 
 ```bash
-srk render consolidated --input security_reports --output security_reports --target sec-report-kit
+srk render consolidated --input security_reports --output security_reports --source consolidated --target sec-report-kit
 ```
 
 This command writes `consolidated-security-report.html` to the output folder.
@@ -68,14 +68,16 @@ The consolidated renderer reads raw JSON/SARIF inputs, generates the per-tool HT
 Example with implicit output folder:
 
 ```bash
-srk render consolidated --input security_reports --target sec-report-kit
+srk render consolidated --input security_reports --source consolidated --target sec-report-kit
 ```
 
+All render commands accept both `--source` and `--target` so callers can control the header values shown as `Source:` and `Target:` in generated HTML.
+
 ## Helper Scripts (bat/sh)
 
 Cross-platform helper scripts are available in `scripts/`.
 
-When render helpers are called without an explicit `<target_name>`, they automatically use the repository root folder name as the report target label.
+When render helpers are called without an explicit `<target_name>`, they automatically use the repository root folder name as the report target label. If `<source_name>` is omitted, each helper uses its tool name (for example `trivy`, `gitleaks`, `consolidated`).
 
 Install this package and Python-installable scanners:
 
@@ -154,7 +156,7 @@ scripts\run_safety.bat security_reports requirements.txt
 > download the vulnerability DB while online and cache it locally:
 >
 > ```bash
-> # Linux/macOS — download once, reuse offline
+When render helpers are called without an explicit `<target_name>`, they automatically use the repository root folder name as the report target label. If `<source_name>` is omitted, each helper uses its tool name (for example `trivy`, `gitleaks`, `consolidated`).
 > bash scripts/download_safety_db.sh
 >
 > # Windows
@@ -186,25 +188,29 @@ scripts\run_bandit.bat security_reports src
 Convert pip-audit JSON report to HTML:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> <source_name>)
 bash scripts/render_pip_audit_html.sh
 bash scripts/render_pip_audit_html.sh reports requirements.txt
+bash scripts/render_pip_audit_html.sh reports requirements.txt sbom-scan
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> <source_name>)
 scripts\render_pip_audit_html.bat
 scripts\render_pip_audit_html.bat reports requirements.txt
+scripts\render_pip_audit_html.bat reports requirements.txt sbom-scan
 ```
 
 Convert Safety JSON report to HTML:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> <source_name>)
 bash scripts/render_safety_html.sh
 bash scripts/render_safety_html.sh security_reports requirements.txt
+bash scripts/render_safety_html.sh security_reports requirements.txt safety-db
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> <source_name>)
 scripts\render_safety_html.bat
 scripts\render_safety_html.bat security_reports requirements.txt
+scripts\render_safety_html.bat security_reports requirements.txt safety-db
 ```
 
 These render helpers generate the HTML file and open it automatically in your default browser.
@@ -212,27 +218,33 @@ These render helpers generate the HTML file and open it automatically in your de
 Convert sample Trivy JSON report to HTML:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> <source_name>)
 bash scripts/render_trivy_html.sh
 bash scripts/render_trivy_html.sh security_reports my-image
+bash scripts/render_trivy_html.sh security_reports my-image image-scan
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> <source_name>)
 scripts\render_trivy_html.bat
 scripts\render_trivy_html.bat security_reports my-image
+scripts\render_trivy_html.bat security_reports my-image image-scan
 ```
 
 Convert all supported scanner reports in a folder to one consolidated HTML report:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> [source_name])
 bash scripts/render_consolidated_html.sh
 bash scripts/render_consolidated_html.sh security_reports sec-report-kit
+bash scripts/render_consolidated_html.sh security_reports sec-report-kit consolidated-dashboard
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> [source_name])
 scripts\render_consolidated_html.bat
 scripts\render_consolidated_html.bat security_reports sec-report-kit
+scripts\render_consolidated_html.bat security_reports sec-report-kit consolidated-dashboard
 ```
 
+For consolidated scripts, when the 3rd argument starts with `--`, it is treated as an extra CLI option (for backward compatibility with existing `--modified-since` usage).
+
 You can also restrict which report files are picked up by modification time and cap how many of the newest files are included:
 
 ```bash
@@ -266,25 +278,29 @@ scripts\render_consolidated_html.bat security_reports sec-report-kit --modified-
 Convert sample Bandit JSON report to HTML:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> <source_name>)
 bash scripts/render_bandit_html.sh
 bash scripts/render_bandit_html.sh security_reports my-python-project
+bash scripts/render_bandit_html.sh security_reports my-python-project python-sast
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> <source_name>)
 scripts\render_bandit_html.bat
 scripts\render_bandit_html.bat security_reports my-python-project
+scripts\render_bandit_html.bat security_reports my-python-project python-sast
 ```
 
 Convert sample Gitleaks JSON report to HTML:
 
 ```bash
-# Linux/macOS (optional args: <report_dir> <target_name>)
+# Linux/macOS (optional args: <report_dir> <target_name> <source_name>)
 bash scripts/render_gitleaks_html.sh
 bash scripts/render_gitleaks_html.sh security_reports my-repository
+bash scripts/render_gitleaks_html.sh security_reports my-repository secret-scan
 
-# Windows (optional args: <report_dir> <target_name>)
+# Windows (optional args: <report_dir> <target_name> <source_name>)
 scripts\render_gitleaks_html.bat
 scripts\render_gitleaks_html.bat security_reports my-repository
+scripts\render_gitleaks_html.bat security_reports my-repository secret-scan
 ```
 
 By default, JSON is written to `reports/pip-audit.json` and HTML to `reports/pip-audit-report.html`.
@@ -372,16 +388,16 @@ scripts\render_gitleaks_html.bat security_reports my-repository
 Manual CLI render examples:
 
 ```bash
-srk render semgrep --input security_reports/semgrep.json --output security_reports/semgrep-report.html --target my-repo
-srk render codeql --input security_reports/codeql.sarif.json --output security_reports/codeql-report.html --target my-repo
-srk render osv-scanner --input security_reports/osv-scanner.json --output security_reports/osv-scanner-report.html --target requirements.txt
-srk render safety --input security_reports/safety.json --output security_reports/safety-report.html --target requirements.txt
-srk render checkov --input security_reports/checkov.json --output security_reports/checkov-report.html --target terraform
-srk render tfsec --input security_reports/tfsec.json --output security_reports/tfsec-report.html --target terraform
-srk render trufflehog --input security_reports/trufflehog.json --output security_reports/trufflehog-report.html --target my-repo
-srk render bandit --input security_reports/bandit.json --output security_reports/bandit-report.html --target my-python-project
-srk render gitleaks --input security_reports/gitleaks.json --output security_reports/gitleaks-report.html --target my-repository
-srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/trivy-report.html --target my-image
+srk render semgrep --input security_reports/semgrep.json --output security_reports/semgrep-report.html --source semgrep --target my-repo
+srk render codeql --input security_reports/codeql.sarif.json --output security_reports/codeql-report.html --source codeql --target my-repo
+srk render osv-scanner --input security_reports/osv-scanner.json --output security_reports/osv-scanner-report.html --source osv-scanner --target requirements.txt
+srk render safety --input security_reports/safety.json --output security_reports/safety-report.html --source safety --target requirements.txt
+srk render checkov --input security_reports/checkov.json --output security_reports/checkov-report.html --source checkov --target terraform
+srk render tfsec --input security_reports/tfsec.json --output security_reports/tfsec-report.html --source tfsec --target terraform
+srk render trufflehog --input security_reports/trufflehog.json --output security_reports/trufflehog-report.html --source trufflehog --target my-repo
+srk render bandit --input security_reports/bandit.json --output security_reports/bandit-report.html --source bandit --target my-python-project
+srk render gitleaks --input security_reports/gitleaks.json --output security_reports/gitleaks-report.html --source gitleaks --target my-repository
+srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/trivy-report.html --source trivy --target my-image
 ```
 
 ## MCP Server

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sec-report-kit"
-version = "0.3.4"
+version = "0.4.4"
 description = "Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON"
 readme = "README.md"
 requires-python = ">=3.10"

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/requirements.txt

@@ -12,7 +12,7 @@ charset-normalizer==3.4.7
 click==8.3.3
 colorama==0.4.6
 coverage==7.14.0
-cryptography==47.0.0
+cryptography==48.0.1
 cyclonedx-python-lib==11.7.0
 defusedxml==0.7.1
 docutils==0.22.4
@@ -22,7 +22,7 @@ httpcore==1.0.9
 httpx==0.28.1
 httpx-sse==0.4.3
 id==1.6.1
-idna==3.13
+idna==3.15
 iniconfig==2.3.0
 jaraco.classes==3.4.0
 jaraco.context==6.1.2
@@ -35,7 +35,7 @@ markdown-it-py==4.0.0
 mcp==1.27.0
 mdurl==0.1.2
 more-itertools==11.0.2
-msgpack==1.1.2
+msgpack==1.2.1
 nh3==0.3.5
 packageurl-python==0.17.6
 packaging==26.2
@@ -47,17 +47,17 @@ pluggy==1.6.0
 py-serializable==2.1.0
 pycparser==3.0
 pydantic==2.13.3
-pydantic-settings==2.14.0
+pydantic-settings==2.14.2
 pydantic_core==2.46.3
 pyfiglet==1.0.4
 Pygments==2.20.0
-PyJWT==2.12.1
+PyJWT==2.13.0
 pyparsing==3.3.2
 pyproject_hooks==1.2.0
 pytest==9.0.3
 pytest-cov==7.1.0
 python-dotenv==1.2.2
-python-multipart==0.0.27
+python-multipart==0.0.30
 pywin32==311
 pywin32-ctypes==0.2.3
 PyYAML==6.0.3
@@ -72,7 +72,7 @@ rpds-py==0.30.0
 shellingham==1.5.4
 sortedcontainers==2.4.0
 sse-starlette==3.4.1
-starlette==1.0.0
+starlette==1.3.1
 stevedore==5.7.0
 tomli==2.4.1
 tomli_w==1.2.0

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/scripts/render_bandit_html.bat

@@ -9,6 +9,8 @@ if "%REPORT_DIR%"=="" set "REPORT_DIR=security_reports"
 
 set "TARGET_NAME=%~2"
 if "%TARGET_NAME%"=="" for %%I in ("%~dp0..") do set "TARGET_NAME=%%~nxI"
+set "SOURCE_NAME=%~3"
+if "%SOURCE_NAME%"=="" set "SOURCE_NAME=bandit"
 
 set "IN_JSON=%REPORT_DIR%\bandit.json"
 set "OUT_HTML=%REPORT_DIR%\bandit-report.html"
@@ -18,7 +20,7 @@ if not exist "%IN_JSON%" (
   exit /b 1
 )
 
-"%PYTHON_BIN%" -m sec_report_kit render bandit --input "%IN_JSON%" --output "%OUT_HTML%" --target "%TARGET_NAME%"
+"%PYTHON_BIN%" -m sec_report_kit render bandit --input "%IN_JSON%" --output "%OUT_HTML%" --source "%SOURCE_NAME%" --target "%TARGET_NAME%"
 if errorlevel 1 exit /b 1
 
 echo HTML report written to %OUT_HTML%

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/scripts/render_bandit_html.sh

@@ -9,6 +9,7 @@ fi
 REPORT_DIR="${1:-security_reports}"
 ROOT_NAME="$(basename "$(cd "$(dirname "$0")/.." && pwd)")"
 TARGET_NAME="${2:-${ROOT_NAME}}"
+SOURCE_NAME="${3:-bandit}"
 IN_JSON="${REPORT_DIR}/bandit.json"
 OUT_HTML="${REPORT_DIR}/bandit-report.html"
 
@@ -29,7 +30,7 @@ if [[ ! -f "${IN_JSON}" ]]; then
   exit 1
 fi
 
-"${PYTHON_BIN}" -m sec_report_kit render bandit --input "${IN_JSON}" --output "${OUT_HTML}" --target "${TARGET_NAME}"
+"${PYTHON_BIN}" -m sec_report_kit render bandit --input "${IN_JSON}" --output "${OUT_HTML}" --source "${SOURCE_NAME}" --target "${TARGET_NAME}"
 
 echo "HTML report written to ${OUT_HTML}"
 open_html "${OUT_HTML}"

{sec_report_kit-0.3.4 → sec_report_kit-0.4.4}/scripts/render_checkov_html.bat

@@ -9,6 +9,8 @@ if "%REPORT_DIR%"=="" set "REPORT_DIR=security_reports"
 
 set "TARGET_NAME=%~2"
 if "%TARGET_NAME%"=="" for %%I in ("%~dp0..") do set "TARGET_NAME=%%~nxI"
+set "SOURCE_NAME=%~3"
+if "%SOURCE_NAME%"=="" set "SOURCE_NAME=checkov"
 
 set "IN_JSON=%REPORT_DIR%\checkov.json"
 set "OUT_HTML=%REPORT_DIR%\checkov-report.html"
@@ -19,7 +21,7 @@ if not exist "%IN_JSON%" (
   exit /b 1
 )
 
-"%PYTHON_BIN%" -m sec_report_kit render checkov --input "%IN_JSON%" --output "%OUT_HTML%" --target "%TARGET_NAME%"
+"%PYTHON_BIN%" -m sec_report_kit render checkov --input "%IN_JSON%" --output "%OUT_HTML%" --source "%SOURCE_NAME%" --target "%TARGET_NAME%"
 if errorlevel 1 exit /b 1
 
 echo HTML report written to %OUT_HTML%