security-use 0.1.1__py3-none-any.whl → 0.2.9__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- security_use/__init__.py +9 -1
- security_use/auth/__init__.py +16 -0
- security_use/auth/client.py +223 -0
- security_use/auth/config.py +177 -0
- security_use/auth/oauth.py +317 -0
- security_use/cli.py +699 -34
- security_use/compliance/__init__.py +10 -0
- security_use/compliance/mapper.py +275 -0
- security_use/compliance/models.py +50 -0
- security_use/dependency_scanner.py +76 -30
- security_use/fixers/iac_fixer.py +173 -95
- security_use/iac/rules/azure.py +246 -0
- security_use/iac/rules/gcp.py +255 -0
- security_use/iac/rules/kubernetes.py +429 -0
- security_use/iac/rules/registry.py +56 -0
- security_use/parsers/__init__.py +18 -0
- security_use/parsers/base.py +2 -0
- security_use/parsers/composer.py +101 -0
- security_use/parsers/conda.py +97 -0
- security_use/parsers/dotnet.py +89 -0
- security_use/parsers/gradle.py +90 -0
- security_use/parsers/maven.py +108 -0
- security_use/parsers/npm.py +196 -0
- security_use/parsers/yarn.py +108 -0
- security_use/reporter.py +29 -1
- security_use/sbom/__init__.py +10 -0
- security_use/sbom/generator.py +340 -0
- security_use/sbom/models.py +40 -0
- security_use/scanner.py +15 -2
- security_use/sensor/__init__.py +125 -0
- security_use/sensor/alert_queue.py +207 -0
- security_use/sensor/config.py +217 -0
- security_use/sensor/dashboard_alerter.py +246 -0
- security_use/sensor/detector.py +415 -0
- security_use/sensor/endpoint_analyzer.py +339 -0
- security_use/sensor/middleware.py +521 -0
- security_use/sensor/models.py +140 -0
- security_use/sensor/webhook.py +227 -0
- security_use-0.2.9.dist-info/METADATA +531 -0
- security_use-0.2.9.dist-info/RECORD +60 -0
- security_use-0.2.9.dist-info/licenses/LICENSE +21 -0
- security_use-0.1.1.dist-info/METADATA +0 -92
- security_use-0.1.1.dist-info/RECORD +0 -30
- {security_use-0.1.1.dist-info → security_use-0.2.9.dist-info}/WHEEL +0 -0
- {security_use-0.1.1.dist-info → security_use-0.2.9.dist-info}/entry_points.txt +0 -0
|
@@ -0,0 +1,531 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: security-use
|
|
3
|
+
Version: 0.2.9
|
|
4
|
+
Summary: Security scanning tool for dependencies and Infrastructure as Code
|
|
5
|
+
Project-URL: Homepage, https://github.com/security-use/security-use
|
|
6
|
+
Project-URL: Repository, https://github.com/security-use/security-use
|
|
7
|
+
Project-URL: Issues, https://github.com/security-use/security-use/issues
|
|
8
|
+
Author-email: Security Use <security@example.com>
|
|
9
|
+
License-Expression: MIT
|
|
10
|
+
License-File: LICENSE
|
|
11
|
+
Keywords: cloudformation,dependencies,iac,scanner,security,terraform,vulnerability
|
|
12
|
+
Classifier: Development Status :: 3 - Alpha
|
|
13
|
+
Classifier: Environment :: Console
|
|
14
|
+
Classifier: Intended Audience :: Developers
|
|
15
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
16
|
+
Classifier: Operating System :: OS Independent
|
|
17
|
+
Classifier: Programming Language :: Python :: 3
|
|
18
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
21
|
+
Classifier: Topic :: Security
|
|
22
|
+
Classifier: Topic :: Software Development :: Quality Assurance
|
|
23
|
+
Requires-Python: >=3.10
|
|
24
|
+
Requires-Dist: click>=8.0.0
|
|
25
|
+
Requires-Dist: httpx>=0.25.0
|
|
26
|
+
Requires-Dist: packaging>=23.0
|
|
27
|
+
Requires-Dist: python-hcl2>=4.3.0
|
|
28
|
+
Requires-Dist: pyyaml>=6.0
|
|
29
|
+
Requires-Dist: rich>=13.0.0
|
|
30
|
+
Requires-Dist: tomli>=2.0.0; python_version < '3.11'
|
|
31
|
+
Provides-Extra: dev
|
|
32
|
+
Requires-Dist: mypy>=1.0.0; extra == 'dev'
|
|
33
|
+
Requires-Dist: pytest-asyncio>=0.21.0; extra == 'dev'
|
|
34
|
+
Requires-Dist: pytest>=7.0.0; extra == 'dev'
|
|
35
|
+
Requires-Dist: ruff>=0.1.0; extra == 'dev'
|
|
36
|
+
Requires-Dist: types-pyyaml>=6.0.0; extra == 'dev'
|
|
37
|
+
Provides-Extra: sensor
|
|
38
|
+
Requires-Dist: fastapi>=0.100.0; extra == 'sensor'
|
|
39
|
+
Requires-Dist: flask>=2.0.0; extra == 'sensor'
|
|
40
|
+
Description-Content-Type: text/markdown
|
|
41
|
+
|
|
42
|
+
<p align="center">
|
|
43
|
+
<a href="https://security-use.dev">
|
|
44
|
+
<img src="assets/logo.svg" alt="SecurityUse" width="400">
|
|
45
|
+
</a>
|
|
46
|
+
</p>
|
|
47
|
+
|
|
48
|
+
<p align="center">
|
|
49
|
+
<strong>Comprehensive security scanning for modern applications</strong>
|
|
50
|
+
</p>
|
|
51
|
+
|
|
52
|
+
<p align="center">
|
|
53
|
+
<a href="https://pypi.org/project/security-use/"><img src="https://img.shields.io/pypi/v/security-use?color=5EEAD4&style=flat-square" alt="PyPI"></a>
|
|
54
|
+
<a href="https://pypi.org/project/security-use/"><img src="https://img.shields.io/pypi/pyversions/security-use?color=5EEAD4&style=flat-square" alt="Python Versions"></a>
|
|
55
|
+
<a href="https://github.com/security-use/security-use/blob/main/LICENSE"><img src="https://img.shields.io/github/license/security-use/security-use?color=5EEAD4&style=flat-square" alt="License"></a>
|
|
56
|
+
<a href="https://github.com/security-use/security-use/actions"><img src="https://img.shields.io/github/actions/workflow/status/security-use/security-use/ci.yml?style=flat-square" alt="CI"></a>
|
|
57
|
+
</p>
|
|
58
|
+
|
|
59
|
+
<p align="center">
|
|
60
|
+
<a href="#installation">Installation</a> •
|
|
61
|
+
<a href="#quick-start">Quick Start</a> •
|
|
62
|
+
<a href="#features">Features</a> •
|
|
63
|
+
<a href="#contributing">Contributing</a>
|
|
64
|
+
</p>
|
|
65
|
+
|
|
66
|
+
---
|
|
67
|
+
|
|
68
|
+
## Overview
|
|
69
|
+
|
|
70
|
+
**SecurityUse** is a unified security scanning platform for Python applications. It detects vulnerabilities in dependencies, misconfigurations in Infrastructure as Code, and provides runtime attack detection for web applications.
|
|
71
|
+
|
|
72
|
+
```bash
|
|
73
|
+
$ security-use scan all ./my-project
|
|
74
|
+
|
|
75
|
+
SecurityUse v0.2.9
|
|
76
|
+
|
|
77
|
+
Scanning dependencies...
|
|
78
|
+
✓ Found 3 vulnerabilities in 47 packages
|
|
79
|
+
|
|
80
|
+
Scanning IaC files...
|
|
81
|
+
✓ Found 2 misconfigurations in 5 files
|
|
82
|
+
|
|
83
|
+
┌─────────────────────────────────────────────────────────────────┐
|
|
84
|
+
│ CRITICAL 1 │ HIGH 2 │ MEDIUM 2 │ LOW 0 │
|
|
85
|
+
└─────────────────────────────────────────────────────────────────┘
|
|
86
|
+
|
|
87
|
+
Results synced to dashboard (5 finding(s))
|
|
88
|
+
```
|
|
89
|
+
|
|
90
|
+
## Features
|
|
91
|
+
|
|
92
|
+
### Dependency Vulnerability Scanning
|
|
93
|
+
|
|
94
|
+
Detect known CVEs in your Python dependencies using the [OSV database](https://osv.dev/).
|
|
95
|
+
|
|
96
|
+
- **Multi-format support**: `requirements.txt`, `Pipfile`, `pyproject.toml`, `poetry.lock`, `package.json`, `pom.xml`
|
|
97
|
+
- **Accurate matching**: Uses package ecosystem data for precise vulnerability matching
|
|
98
|
+
- **Severity scoring**: CVSS-based severity ratings (Critical, High, Medium, Low)
|
|
99
|
+
- **Fix suggestions**: Recommends safe versions to upgrade to
|
|
100
|
+
|
|
101
|
+
### Infrastructure as Code Scanning
|
|
102
|
+
|
|
103
|
+
Find security misconfigurations before they reach production.
|
|
104
|
+
|
|
105
|
+
| Platform | Formats | Rules |
|
|
106
|
+
|----------|---------|-------|
|
|
107
|
+
| **Terraform** | `.tf`, `.tf.json` | 25+ |
|
|
108
|
+
| **CloudFormation** | `.yaml`, `.yml`, `.json` | 20+ |
|
|
109
|
+
| **AWS** | S3, EC2, IAM, RDS, Lambda | Full coverage |
|
|
110
|
+
|
|
111
|
+
**Detects:**
|
|
112
|
+
- Unencrypted storage and databases
|
|
113
|
+
- Overly permissive IAM policies
|
|
114
|
+
- Public access to sensitive resources
|
|
115
|
+
- Missing logging and monitoring
|
|
116
|
+
- Insecure network configurations
|
|
117
|
+
|
|
118
|
+
### Runtime Security Sensor
|
|
119
|
+
|
|
120
|
+
Real-time attack detection middleware for FastAPI and Flask applications with dashboard integration.
|
|
121
|
+
|
|
122
|
+
```python
|
|
123
|
+
from fastapi import FastAPI
|
|
124
|
+
from security_use.sensor import SecurityMiddleware
|
|
125
|
+
|
|
126
|
+
app = FastAPI()
|
|
127
|
+
|
|
128
|
+
# Dashboard integration (recommended)
|
|
129
|
+
app.add_middleware(
|
|
130
|
+
SecurityMiddleware,
|
|
131
|
+
api_key="su_...", # Or set SECURITY_USE_API_KEY env var
|
|
132
|
+
block_on_detection=True,
|
|
133
|
+
)
|
|
134
|
+
|
|
135
|
+
# Auto-detect vulnerable endpoints from code analysis
|
|
136
|
+
app.add_middleware(
|
|
137
|
+
SecurityMiddleware,
|
|
138
|
+
auto_detect_vulnerable=True,
|
|
139
|
+
project_path="./",
|
|
140
|
+
)
|
|
141
|
+
|
|
142
|
+
# Selective path monitoring
|
|
143
|
+
app.add_middleware(
|
|
144
|
+
SecurityMiddleware,
|
|
145
|
+
watch_paths=["/api/users", "/api/search", "/admin/*"],
|
|
146
|
+
excluded_paths=["/health", "/metrics"],
|
|
147
|
+
)
|
|
148
|
+
```
|
|
149
|
+
|
|
150
|
+
**Detects:**
|
|
151
|
+
- SQL Injection (`' OR 1=1--`, `UNION SELECT`, etc.)
|
|
152
|
+
- Cross-Site Scripting (`<script>`, `javascript:`, event handlers)
|
|
153
|
+
- Path Traversal (`../`, `%2e%2e%2f`, etc.)
|
|
154
|
+
- Command Injection (`;cat /etc/passwd`, backticks, `$()`)
|
|
155
|
+
- Rate limit violations
|
|
156
|
+
- Suspicious user agents (sqlmap, nikto, etc.)
|
|
157
|
+
|
|
158
|
+
**Features:**
|
|
159
|
+
- Dashboard alerting with API key authentication
|
|
160
|
+
- Auto-detection of vulnerable endpoints via code analysis
|
|
161
|
+
- Selective path monitoring with wildcards
|
|
162
|
+
- Blocks attacks and reports to dashboard in real-time
|
|
163
|
+
|
|
164
|
+
### Auto-Fix
|
|
165
|
+
|
|
166
|
+
Automatically remediate security issues with a single command.
|
|
167
|
+
|
|
168
|
+
```bash
|
|
169
|
+
security-use fix ./my-project
|
|
170
|
+
```
|
|
171
|
+
|
|
172
|
+
**Dependency Fixes:**
|
|
173
|
+
- Updates vulnerable packages to patched versions
|
|
174
|
+
- Supports `requirements.txt`, `Pipfile`, `pyproject.toml`
|
|
175
|
+
|
|
176
|
+
**IaC Fixes:**
|
|
177
|
+
|
|
178
|
+
| Rule | Issue | Auto-Fix |
|
|
179
|
+
|------|-------|----------|
|
|
180
|
+
| CKV_AWS_19 | S3 bucket without encryption | Adds AES256 server-side encryption |
|
|
181
|
+
| CKV_AWS_20 | S3 bucket with public access | Changes ACL to private |
|
|
182
|
+
| CKV_AWS_3 | EBS volume unencrypted | Sets `encrypted = true` |
|
|
183
|
+
| CKV_AWS_16 | RDS instance unencrypted | Adds `storage_encrypted = true` |
|
|
184
|
+
| CKV_AWS_23 | Open security group ingress | Restricts CIDR blocks |
|
|
185
|
+
|
|
186
|
+
### Dashboard Integration
|
|
187
|
+
|
|
188
|
+
Sync your scan results to the [SecurityUse Dashboard](https://security-use.dev) for centralized monitoring, trend analysis, and team collaboration.
|
|
189
|
+
|
|
190
|
+
```bash
|
|
191
|
+
# Authenticate once
|
|
192
|
+
security-use auth login
|
|
193
|
+
|
|
194
|
+
# All scans now auto-sync to dashboard!
|
|
195
|
+
security-use scan all ./my-project
|
|
196
|
+
# → Results synced to dashboard (X finding(s))
|
|
197
|
+
```
|
|
198
|
+
|
|
199
|
+
**Features:**
|
|
200
|
+
- **Automatic sync**: Once logged in, all scan results are automatically uploaded
|
|
201
|
+
- **Multi-repo support**: Each repository is tracked separately with git metadata
|
|
202
|
+
- **No extra commands**: Just run your normal scans - syncing happens automatically
|
|
203
|
+
|
|
204
|
+
```bash
|
|
205
|
+
# Auth commands
|
|
206
|
+
security-use auth login # Authenticate with dashboard
|
|
207
|
+
security-use auth status # Check authentication status
|
|
208
|
+
security-use auth logout # Clear credentials
|
|
209
|
+
|
|
210
|
+
# Manual sync (if needed)
|
|
211
|
+
security-use sync ./my-project --project "My App"
|
|
212
|
+
```
|
|
213
|
+
|
|
214
|
+
## Installation
|
|
215
|
+
|
|
216
|
+
```bash
|
|
217
|
+
pip install security-use
|
|
218
|
+
```
|
|
219
|
+
|
|
220
|
+
**With optional dependencies:**
|
|
221
|
+
|
|
222
|
+
```bash
|
|
223
|
+
# For runtime sensor with FastAPI/Flask
|
|
224
|
+
pip install security-use[sensor]
|
|
225
|
+
|
|
226
|
+
# For development
|
|
227
|
+
pip install security-use[dev]
|
|
228
|
+
```
|
|
229
|
+
|
|
230
|
+
**Requirements:** Python 3.10+
|
|
231
|
+
|
|
232
|
+
## Quick Start
|
|
233
|
+
|
|
234
|
+
### Command Line Interface
|
|
235
|
+
|
|
236
|
+
```bash
|
|
237
|
+
# Scan dependencies for vulnerabilities
|
|
238
|
+
security-use scan deps ./my-project
|
|
239
|
+
|
|
240
|
+
# Scan Infrastructure as Code
|
|
241
|
+
security-use scan iac ./terraform
|
|
242
|
+
|
|
243
|
+
# Scan everything
|
|
244
|
+
security-use scan all ./my-project
|
|
245
|
+
|
|
246
|
+
# Output as JSON
|
|
247
|
+
security-use scan all ./my-project --format json
|
|
248
|
+
|
|
249
|
+
# Output as SARIF (for GitHub Code Scanning)
|
|
250
|
+
security-use scan all ./my-project --format sarif > results.sarif
|
|
251
|
+
|
|
252
|
+
# Auto-fix vulnerabilities and IaC misconfigurations
|
|
253
|
+
security-use fix ./my-project
|
|
254
|
+
|
|
255
|
+
# Auto-fix with options
|
|
256
|
+
security-use fix ./my-project --dry-run # Preview changes
|
|
257
|
+
security-use fix ./my-project --deps-only # Only fix dependencies
|
|
258
|
+
security-use fix ./my-project --iac-only # Only fix IaC issues
|
|
259
|
+
|
|
260
|
+
# Dashboard integration (results auto-sync when logged in)
|
|
261
|
+
security-use auth login # Authenticate with dashboard
|
|
262
|
+
security-use auth status # Check auth status
|
|
263
|
+
security-use auth logout # Clear credentials
|
|
264
|
+
```
|
|
265
|
+
|
|
266
|
+
### Python API
|
|
267
|
+
|
|
268
|
+
```python
|
|
269
|
+
from security_use import scan_dependencies, scan_iac
|
|
270
|
+
|
|
271
|
+
# Scan dependencies
|
|
272
|
+
result = scan_dependencies("./my-project")
|
|
273
|
+
|
|
274
|
+
print(f"Found {len(result.vulnerabilities)} vulnerabilities")
|
|
275
|
+
for vuln in result.vulnerabilities:
|
|
276
|
+
print(f" {vuln.severity.value}: {vuln.package} - {vuln.title}")
|
|
277
|
+
|
|
278
|
+
# Scan IaC
|
|
279
|
+
result = scan_iac("./terraform")
|
|
280
|
+
|
|
281
|
+
for finding in result.iac_findings:
|
|
282
|
+
print(f" [{finding.severity.value}] {finding.rule_id}")
|
|
283
|
+
print(f" {finding.title}")
|
|
284
|
+
print(f" {finding.file_path}:{finding.line_number}")
|
|
285
|
+
```
|
|
286
|
+
|
|
287
|
+
### Runtime Sensor
|
|
288
|
+
|
|
289
|
+
**FastAPI (ASGI) with Dashboard:**
|
|
290
|
+
|
|
291
|
+
```python
|
|
292
|
+
from fastapi import FastAPI
|
|
293
|
+
from security_use.sensor import SecurityMiddleware
|
|
294
|
+
|
|
295
|
+
app = FastAPI()
|
|
296
|
+
|
|
297
|
+
# Recommended: Dashboard integration
|
|
298
|
+
app.add_middleware(
|
|
299
|
+
SecurityMiddleware,
|
|
300
|
+
api_key="su_...", # Or set SECURITY_USE_API_KEY env var
|
|
301
|
+
block_on_detection=True, # Return 403 on attacks (default)
|
|
302
|
+
excluded_paths=["/health", "/metrics"],
|
|
303
|
+
rate_limit_threshold=100, # Requests per minute per IP
|
|
304
|
+
)
|
|
305
|
+
|
|
306
|
+
# Or with auto-detection of vulnerable endpoints
|
|
307
|
+
app.add_middleware(
|
|
308
|
+
SecurityMiddleware,
|
|
309
|
+
api_key="su_...",
|
|
310
|
+
auto_detect_vulnerable=True, # Scan code for risky endpoints
|
|
311
|
+
project_path="./",
|
|
312
|
+
)
|
|
313
|
+
|
|
314
|
+
# Or monitor specific paths only
|
|
315
|
+
app.add_middleware(
|
|
316
|
+
SecurityMiddleware,
|
|
317
|
+
api_key="su_...",
|
|
318
|
+
watch_paths=["/api/users", "/admin/*"], # Only monitor these
|
|
319
|
+
)
|
|
320
|
+
|
|
321
|
+
@app.get("/api/users")
|
|
322
|
+
def get_users():
|
|
323
|
+
return {"users": []}
|
|
324
|
+
```
|
|
325
|
+
|
|
326
|
+
**Flask (WSGI):**
|
|
327
|
+
|
|
328
|
+
```python
|
|
329
|
+
from flask import Flask
|
|
330
|
+
from security_use.sensor import FlaskSecurityMiddleware
|
|
331
|
+
|
|
332
|
+
app = Flask(__name__)
|
|
333
|
+
|
|
334
|
+
app.wsgi_app = FlaskSecurityMiddleware(
|
|
335
|
+
app.wsgi_app,
|
|
336
|
+
api_key="su_...", # Dashboard integration
|
|
337
|
+
block_on_detection=True,
|
|
338
|
+
)
|
|
339
|
+
|
|
340
|
+
@app.route("/api/users")
|
|
341
|
+
def get_users():
|
|
342
|
+
return {"users": []}
|
|
343
|
+
```
|
|
344
|
+
|
|
345
|
+
**Programmatic Endpoint Analysis:**
|
|
346
|
+
|
|
347
|
+
```python
|
|
348
|
+
from security_use.sensor import VulnerableEndpointDetector
|
|
349
|
+
|
|
350
|
+
# Analyze your codebase for vulnerable endpoints
|
|
351
|
+
detector = VulnerableEndpointDetector()
|
|
352
|
+
result = detector.analyze("./my-project")
|
|
353
|
+
|
|
354
|
+
for endpoint in result.vulnerable_endpoints:
|
|
355
|
+
print(f"{endpoint.method} {endpoint.path} - risk: {endpoint.risk_score}")
|
|
356
|
+
```
|
|
357
|
+
|
|
358
|
+
**Dashboard Alert Format:**
|
|
359
|
+
|
|
360
|
+
```json
|
|
361
|
+
{
|
|
362
|
+
"scan_type": "runtime",
|
|
363
|
+
"status": "completed",
|
|
364
|
+
"findings": [{
|
|
365
|
+
"finding_type": "attack",
|
|
366
|
+
"category": "runtime",
|
|
367
|
+
"severity": "HIGH",
|
|
368
|
+
"title": "Sql Injection attack detected",
|
|
369
|
+
"description": "UNION SELECT injection attempt",
|
|
370
|
+
"pattern": "(?i)union\\s+(all\\s+)?select",
|
|
371
|
+
"payload_preview": "1 UNION SELECT * FROM users--",
|
|
372
|
+
"recommendation": "Review and parameterize database queries.",
|
|
373
|
+
"file_path": "/api/users",
|
|
374
|
+
"metadata": {
|
|
375
|
+
"source_ip": "192.168.1.100",
|
|
376
|
+
"method": "GET",
|
|
377
|
+
"user_agent": "Mozilla/5.0...",
|
|
378
|
+
"action_taken": "blocked",
|
|
379
|
+
"confidence": 0.9,
|
|
380
|
+
"timestamp": "2024-01-25T12:00:00.000000"
|
|
381
|
+
}
|
|
382
|
+
}],
|
|
383
|
+
"metadata": {
|
|
384
|
+
"sensor_version": "0.2.9",
|
|
385
|
+
"alert_type": "runtime_attack"
|
|
386
|
+
}
|
|
387
|
+
}
|
|
388
|
+
```
|
|
389
|
+
|
|
390
|
+
## Supported Formats
|
|
391
|
+
|
|
392
|
+
### Dependency Files
|
|
393
|
+
|
|
394
|
+
| Ecosystem | File | Status |
|
|
395
|
+
|-----------|------|--------|
|
|
396
|
+
| Python | `requirements.txt` | ✅ Full support |
|
|
397
|
+
| Python | `Pipfile` / `Pipfile.lock` | ✅ Full support |
|
|
398
|
+
| Python | `pyproject.toml` | ✅ Full support |
|
|
399
|
+
| Python | `poetry.lock` | ✅ Full support |
|
|
400
|
+
| JavaScript | `package.json` / `package-lock.json` | ✅ Full support |
|
|
401
|
+
| Java | `pom.xml` | ✅ Full support |
|
|
402
|
+
|
|
403
|
+
### IaC Formats
|
|
404
|
+
|
|
405
|
+
| Platform | Format | Status |
|
|
406
|
+
|----------|--------|--------|
|
|
407
|
+
| Terraform | `.tf` (HCL2) | ✅ Full support |
|
|
408
|
+
| Terraform | `.tf.json` | ✅ Full support |
|
|
409
|
+
| CloudFormation | `.yaml` / `.yml` | ✅ Full support |
|
|
410
|
+
| CloudFormation | `.json` | ✅ Full support |
|
|
411
|
+
|
|
412
|
+
## CI/CD Integration
|
|
413
|
+
|
|
414
|
+
### GitHub Actions
|
|
415
|
+
|
|
416
|
+
```yaml
|
|
417
|
+
name: Security Scan
|
|
418
|
+
|
|
419
|
+
on: [push, pull_request]
|
|
420
|
+
|
|
421
|
+
jobs:
|
|
422
|
+
security:
|
|
423
|
+
runs-on: ubuntu-latest
|
|
424
|
+
steps:
|
|
425
|
+
- uses: actions/checkout@v4
|
|
426
|
+
|
|
427
|
+
- name: Set up Python
|
|
428
|
+
uses: actions/setup-python@v5
|
|
429
|
+
with:
|
|
430
|
+
python-version: '3.11'
|
|
431
|
+
|
|
432
|
+
- name: Install SecurityUse
|
|
433
|
+
run: pip install security-use
|
|
434
|
+
|
|
435
|
+
- name: Run security scan
|
|
436
|
+
run: security-use scan all . --format sarif > results.sarif
|
|
437
|
+
|
|
438
|
+
- name: Upload SARIF results
|
|
439
|
+
uses: github/codeql-action/upload-sarif@v3
|
|
440
|
+
with:
|
|
441
|
+
sarif_file: results.sarif
|
|
442
|
+
```
|
|
443
|
+
|
|
444
|
+
### GitLab CI
|
|
445
|
+
|
|
446
|
+
```yaml
|
|
447
|
+
security-scan:
|
|
448
|
+
image: python:3.11
|
|
449
|
+
script:
|
|
450
|
+
- pip install security-use
|
|
451
|
+
- security-use scan all . --format json > security-report.json
|
|
452
|
+
artifacts:
|
|
453
|
+
reports:
|
|
454
|
+
security: security-report.json
|
|
455
|
+
```
|
|
456
|
+
|
|
457
|
+
### Pre-commit Hook
|
|
458
|
+
|
|
459
|
+
```yaml
|
|
460
|
+
# .pre-commit-config.yaml
|
|
461
|
+
repos:
|
|
462
|
+
- repo: local
|
|
463
|
+
hooks:
|
|
464
|
+
- id: security-use
|
|
465
|
+
name: Security Scan
|
|
466
|
+
entry: security-use scan deps . --fail-on high
|
|
467
|
+
language: python
|
|
468
|
+
additional_dependencies: [security-use]
|
|
469
|
+
pass_filenames: false
|
|
470
|
+
```
|
|
471
|
+
|
|
472
|
+
## Configuration
|
|
473
|
+
|
|
474
|
+
Create a `security-use.yaml` in your project root:
|
|
475
|
+
|
|
476
|
+
```yaml
|
|
477
|
+
# Dependency scanning
|
|
478
|
+
dependencies:
|
|
479
|
+
enabled: true
|
|
480
|
+
fail_on: high # critical, high, medium, low
|
|
481
|
+
ignore:
|
|
482
|
+
- CVE-2021-12345 # Known false positive
|
|
483
|
+
|
|
484
|
+
# IaC scanning
|
|
485
|
+
iac:
|
|
486
|
+
enabled: true
|
|
487
|
+
fail_on: high
|
|
488
|
+
exclude_paths:
|
|
489
|
+
- "examples/"
|
|
490
|
+
- "test/"
|
|
491
|
+
|
|
492
|
+
# Output
|
|
493
|
+
output:
|
|
494
|
+
format: table # table, json, sarif
|
|
495
|
+
verbose: false
|
|
496
|
+
```
|
|
497
|
+
|
|
498
|
+
## Contributing
|
|
499
|
+
|
|
500
|
+
We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) for details.
|
|
501
|
+
|
|
502
|
+
```bash
|
|
503
|
+
# Clone the repository
|
|
504
|
+
git clone https://github.com/security-use/security-use.git
|
|
505
|
+
cd security-use
|
|
506
|
+
|
|
507
|
+
# Install development dependencies
|
|
508
|
+
pip install -e ".[dev]"
|
|
509
|
+
|
|
510
|
+
# Run tests
|
|
511
|
+
pytest
|
|
512
|
+
|
|
513
|
+
# Run linting
|
|
514
|
+
ruff check .
|
|
515
|
+
```
|
|
516
|
+
|
|
517
|
+
## Security
|
|
518
|
+
|
|
519
|
+
Found a security vulnerability? Please report it privately via [security@security-use.dev](mailto:security@security-use.dev) or through [GitHub Security Advisories](https://github.com/security-use/security-use/security/advisories/new).
|
|
520
|
+
|
|
521
|
+
## License
|
|
522
|
+
|
|
523
|
+
[MIT License](LICENSE) - see the [LICENSE](LICENSE) file for details.
|
|
524
|
+
|
|
525
|
+
---
|
|
526
|
+
|
|
527
|
+
<p align="center">
|
|
528
|
+
<a href="https://security-use.dev">Website</a> •
|
|
529
|
+
<a href="https://github.com/security-use/security-use">GitHub</a> •
|
|
530
|
+
<a href="https://pypi.org/project/security-use/">PyPI</a>
|
|
531
|
+
</p>
|
|
@@ -0,0 +1,60 @@
|
|
|
1
|
+
security_use/__init__.py,sha256=HwzyaY3szLPfPgKCtheGLUocHbtEoFQqgNZ8Qz8ZiJI,538
|
|
2
|
+
security_use/cli.py,sha256=7dDeYXbR3fsEXGWrtJmUXN4qvaNgRAklNsN33TC9zO0,33583
|
|
3
|
+
security_use/dependency_scanner.py,sha256=-V4PBwM2FOv0KDziySkqrVrJbEkOy_z-HVT3Dw2Oqvs,7229
|
|
4
|
+
security_use/iac_scanner.py,sha256=ObnVJU74nSS9OoAZmhJOA79_FcvlzIgxOcuWAMkSliA,6714
|
|
5
|
+
security_use/models.py,sha256=0vvcV-Cyn_0-Itn0c-apsWz3GBGqN1BMPZeP_MxlXb8,4092
|
|
6
|
+
security_use/osv_client.py,sha256=yKJVTbKU3fP0QM69KMYWA2xTDOAfKmEQOn5BLhQ8lY8,13380
|
|
7
|
+
security_use/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
8
|
+
security_use/reporter.py,sha256=T2UZONMF9ENQERelF1t95FJe5N0BlTqwZBrN6pWiaVA,13794
|
|
9
|
+
security_use/scanner.py,sha256=T1so6dfTl1cesesrAyX09-tFDRyN2u6QiAQYZt7Ta4w,2814
|
|
10
|
+
security_use/auth/__init__.py,sha256=8e940VyCJMiQZ6TeEFiWsdIikOhdfKdvMcpYBgApVk4,389
|
|
11
|
+
security_use/auth/client.py,sha256=lADGyYbtcBNF5BSRQwPeuBveaSUwE2rOf54R2uwIWbU,7606
|
|
12
|
+
security_use/auth/config.py,sha256=ARKIjkBVk3GzOLpGhM0uzUVr_xHWYGpPtz9z0UYHgBQ,5326
|
|
13
|
+
security_use/auth/oauth.py,sha256=x6p5A4Uw_NEWNtcboU09k0RomwQnM3xBMy_u-jpy4kk,10858
|
|
14
|
+
security_use/compliance/__init__.py,sha256=l24IA24D-2_qGul3Vb-OmgWg3Wvs1vCnaLRbQEefMfo,277
|
|
15
|
+
security_use/compliance/mapper.py,sha256=BPKtaHtIcQ8n5S99DrUk8DWB8nQZoffQnF3YDzax44c,11250
|
|
16
|
+
security_use/compliance/models.py,sha256=8mL6ftoLXQ-eU1XK11zFbpY4I0FBAU9pgnnKbhUpKjk,1083
|
|
17
|
+
security_use/fixers/__init__.py,sha256=pBcjyXWiRznnrLyWr2-eXs_4eaAh9L9UJyqGigM1X8c,206
|
|
18
|
+
security_use/fixers/dependency_fixer.py,sha256=zDJadR3ExQ_vqaRgVMZSWqskLRjlf14dk3usNmwTqsM,6415
|
|
19
|
+
security_use/fixers/iac_fixer.py,sha256=aOsXKRbxOrAJ4CidR47ZILRQ2eie1glL8gX2uPINP24,10201
|
|
20
|
+
security_use/iac/__init__.py,sha256=MmabfNA36rJvtWgOUWaq5VJf2TPNWXyhMmVuI8qVHV4,238
|
|
21
|
+
security_use/iac/base.py,sha256=8lrOIwlRbDJYIzb4Epfn1OA91UUjhXHxo61ACwFkhmE,1810
|
|
22
|
+
security_use/iac/cloudformation.py,sha256=6E1fE6xFW4uMlFmuD2cEiubUaOzMlqdcpwWsMfAzJ_c,8197
|
|
23
|
+
security_use/iac/terraform.py,sha256=-0PY-Dw5qpKKn28BliwNv8yRkGp5eGKACwrZVaQ9u80,6191
|
|
24
|
+
security_use/iac/rules/__init__.py,sha256=RfFXACozqDYqV4EYgmRxsvk6rERZP_0qN1L9gZlG5TE,711
|
|
25
|
+
security_use/iac/rules/aws.py,sha256=9KjHv5v3ppanuFOJ-p-_qv-CiehxHBAuwFSF_IL5qOM,12152
|
|
26
|
+
security_use/iac/rules/azure.py,sha256=ICP4xzujz_uxASQkk_OJp76BVW0crVsnF2QL_g-CTtQ,8773
|
|
27
|
+
security_use/iac/rules/base.py,sha256=C-LgpwIUIBAyoPwL-tC_ioF6opbmSk-nRWB_vfM22ec,2567
|
|
28
|
+
security_use/iac/rules/gcp.py,sha256=e400ggCZT96Qi7nGwYaXoNrQ9a7TRsyMgSUkZyPs3ho,9053
|
|
29
|
+
security_use/iac/rules/kubernetes.py,sha256=o3rcdTfhGpl0kYFvJzM_UTlWV7at2V_-BbGEk8dglKU,13685
|
|
30
|
+
security_use/iac/rules/registry.py,sha256=oLhEkEJxahXXzanah57O5-UQw0PpB-GVjYedCZBpJRc,5034
|
|
31
|
+
security_use/parsers/__init__.py,sha256=530zvqLKZgtG_SwoDRyugiND360yF1hfqQHFbJiXOHo,1187
|
|
32
|
+
security_use/parsers/base.py,sha256=rQwpvN407l-2k3KIxXCTtbOY0VjoBSSE_sa2UdHmTeA,1180
|
|
33
|
+
security_use/parsers/composer.py,sha256=uZX-gYABgVogbL7gpFLeJilMfc-8YR9jRkYcIG942Q8,3301
|
|
34
|
+
security_use/parsers/conda.py,sha256=3wSeSJTcYfNrEzr1-GDF426d2PMtPqtnJJzOkP9ef78,3187
|
|
35
|
+
security_use/parsers/dotnet.py,sha256=cKg6A63k9oerHd2ClxLJPfRgI_E9FRN2sTSM17J6v1U,2681
|
|
36
|
+
security_use/parsers/gradle.py,sha256=1XoAwj1JBdHrddZeLKqHk1EhUrbjZeKWKPpyXOmMin0,3180
|
|
37
|
+
security_use/parsers/maven.py,sha256=e5wuVrFiAIxJZZw3zhHhakcaemdAax9mktOubmaUrSs,3436
|
|
38
|
+
security_use/parsers/npm.py,sha256=fpasuqGVdu-Rldd36ntUWJmxGV_E73x8_sr3JLHYE74,6486
|
|
39
|
+
security_use/parsers/pipfile.py,sha256=1cginV92IWvaT4A19ScaLUBy4y3fS5mEXtFpurxFPLI,3800
|
|
40
|
+
security_use/parsers/poetry_lock.py,sha256=OipaEBr03Kkfgt5bTFXCswbiAFcVXEzcz-e-N5jeGWk,1167
|
|
41
|
+
security_use/parsers/pyproject.py,sha256=Tjmb-EZnp22RPsIgFiznSwMXrktLb-_CpT5o7RbXcWc,5407
|
|
42
|
+
security_use/parsers/requirements.py,sha256=slenW0vs1Hd5J7ZOI1YAd9Ha3qV1Fzt_PZ7gErzhha8,2687
|
|
43
|
+
security_use/parsers/yarn.py,sha256=2RpK50QxvO_8MLOR_U0HkYAnlMazj7PojPr_VD2VQh4,3691
|
|
44
|
+
security_use/sbom/__init__.py,sha256=674cA_JO7hOMOT0_uVx02xZjRCzaqep7w9NN0qarg_Q,246
|
|
45
|
+
security_use/sbom/generator.py,sha256=eePEPgJtjlsMZPthYLvLRisX2EIuvdZ5Dwm0_7CXi8Q,11246
|
|
46
|
+
security_use/sbom/models.py,sha256=o1HePyueGzDykr0B8iI_BT1hRjmD2XNtD8xy7cexLHI,984
|
|
47
|
+
security_use/sensor/__init__.py,sha256=UlfkdHtNBxjc27fdC775OvJPlb0rZcpcAyMfTj1JSNs,3252
|
|
48
|
+
security_use/sensor/alert_queue.py,sha256=6YDpAbyVwx2Hdiu_S_FXsxK1GzeWuJDsPWFH91uSCiI,5754
|
|
49
|
+
security_use/sensor/config.py,sha256=N22f8X60-CczTonfV-RY875WfcVXo4eKwws2MdjGQRA,8518
|
|
50
|
+
security_use/sensor/dashboard_alerter.py,sha256=ItRgCgxxj__8B7VVVCJKSIh5zWRzP-2fezBfEsVaS9M,9613
|
|
51
|
+
security_use/sensor/detector.py,sha256=TI1fX_zQvxvxExb_NQKjV_IUie-ne-rUmZSEJnwTibo,15237
|
|
52
|
+
security_use/sensor/endpoint_analyzer.py,sha256=kz3k_qVZSHjeSfko1EqKjWS3rswz5k7v6OBow4Ajf6g,11895
|
|
53
|
+
security_use/sensor/middleware.py,sha256=w9qoGtylZ-3XMFae4F01j1gJGgjsf_Fzxz46uNZYaj8,19430
|
|
54
|
+
security_use/sensor/models.py,sha256=wVrrHV7pEBpKfyHE3YGYti2V6iLUYJoJnjYirmLOqz8,4281
|
|
55
|
+
security_use/sensor/webhook.py,sha256=r5NHVBvYi9zKdCCCMVdf8dEb8gSiCnb2KSvb3gPiKWM,7762
|
|
56
|
+
security_use-0.2.9.dist-info/METADATA,sha256=m4xEzEBOx0MMcoUTLzlc03zkUTC8qGNqMRvmihJWJLg,15180
|
|
57
|
+
security_use-0.2.9.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
|
|
58
|
+
security_use-0.2.9.dist-info/entry_points.txt,sha256=PSZqVVwt2h3HFeoFQCCoscMsJD6C5r3HQGzqcBYCRMM,55
|
|
59
|
+
security_use-0.2.9.dist-info/licenses/LICENSE,sha256=xfESH-dM-nnk6IZg5X6QgfOMzJWtFiLDuEhe2to5CnU,1068
|
|
60
|
+
security_use-0.2.9.dist-info/RECORD,,
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2024 SecurityUse
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|