universal-dev-security 1.0.0__tar.gz

universal_dev_security-1.0.0/CHANGELOG.md

@@ -0,0 +1,88 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+Semantic Versioning (PEP 440 pre-release suffixes).
+
+## [1.0.0] — 2026-11-14
+
+First stable release. Includes everything in 1.0.0rc1 plus improvements from the
+first live scan of a real Next.js project and live verification of the Claude Code hook.
+
+### Added
+- Secret findings record Git exposure (`tracked_in_git`): committed and shared, or local only.
+  Recommendations and the dashboard (`in Git` / `local only` tags) distinguish them; only
+  committed or unknown secrets are reported as urgent rotations.
+- Scan comparisons warn when the scan scope (exclusions) changed, because findings shown as
+  "resolved" may have been excluded rather than fixed (`scope_fingerprint`).
+
+### Changed
+- Findings are ordered by priority: committed secrets first, then severity (critical → unclassified).
+- Secret scanning excludes framework caches and dev-server builds (`.next/cache`, `.next/dev`,
+  `.turbo`, `.parcel-cache`, `.angular/cache`); deployable output (`.next/static`,
+  `.next/server`) is still scanned. On the test project this removed 97% of noise (708 → 29).
+
+### Fixed
+- The scanner coverage table showed `0` findings for scanners that did not run; it now shows `—`.
+- `uds integrate claude-code --python-path` printed a note saying the hook runs `uds` from PATH.
+
+### Verified
+- Claude Code hook verified in live Claude Code 2.1.323 sessions; documented that Claude Code
+  runs project hooks only in trusted workspaces.
+- CI: Windows, Linux and macOS × Python 3.11–3.14 plus real-scanner integration.
+
+## [1.0.0rc1] — 2026-11-14 (GitHub pre-release)
+
+### Added
+- **Policy engine** (`policy.py`): immutable global rules returning allow / ask / deny with risk
+  and reasons; project configuration can only add restrictions; strict mode; `uds policy show|check`.
+- **Configuration loader** with validation and warnings; mandatory settings cannot be disabled;
+  Gitleaks cannot be disabled.
+- **Scanner adapters** for Semgrep, OSV-Scanner (v1 and v2 CLI) and Trivy alongside Gitleaks, with
+  executable discovery, version detection, compatibility checks, applicability detection, and the
+  states clean / findings / not_installed / not_applicable / skipped / error.
+- **Unified findings schema** with severity provenance (`severity_source`), CVSS qualitative scale
+  mapping, stable fingerprints and http(s)-only references.
+- **Reports:** JSON schema 2.0, SARIF 2.1.0, and a redesigned dark dashboard with severity cards,
+  recommendations, scanner coverage, privacy notes, searchable/filterable finding details,
+  scan history, scan comparison and JSON/HTML export; hash-based Content-Security-Policy.
+- **Scan history and comparison** (`uds history`, `uds compare`, `uds report`, `uds dashboard`).
+- **Technology detection** for Python, JavaScript, TypeScript, Node.js, React, Next.js, PHP,
+  WordPress, WooCommerce, Java, .NET, Go, Rust, Ruby, Docker, Terraform and Kubernetes, with
+  evidence and scanner/rule-pack profiles; nested projects supported.
+- **Git protection:** `uds hooks install|uninstall|status`; fail-closed pre-commit and pre-push
+  hooks using Gitleaks with a built-in fallback; foreign hooks and `core.hooksPath` respected.
+- **Claude Code integration:** `PreToolUse` hook (Bash, PowerShell, Write, Edit, MultiEdit,
+  NotebookEdit, Read) that never auto-approves and fails closed; settings merge/removal.
+- **Generic agent protocol:** `uds guard` (JSON in, decision out, documented exit codes).
+- **GitHub integration:** generated least-privilege PR workflow with checksum-verified scanners
+  and SARIF upload. **VS Code** tasks integration.
+- **Recovery engine:** checkpoints, atomic writes, rollback that preserves later user edits.
+- **Automatic fixes:** risk-tiered, reversible, verified by baseline and post-change test runs
+  with automatic rollback. **Testing engine** for pytest, npm, .NET, Maven, Gradle, Go, Cargo, PHPUnit.
+- **Update manager:** explicit, HTTPS-only update checks; scanner version status.
+- **Release tooling:** `scripts/release.py`, user-level installers with checksum verification
+  (`scripts/install.ps1`, `scripts/install.sh`).
+- Cross-platform CI matrix (Windows, Linux, macOS × Python 3.11–3.14) and a real-scanner job.
+
+### Changed
+- `uds scan` runs all enabled, applicable scanners and prints a readable summary (`--json` for
+  machine output). Exit codes: 0 success, 1 threshold reached, 2 error / not scanned.
+- Reports use project-relative paths and are written with LF line endings.
+- `pyproject.toml` uses an SPDX license expression and a single-sourced version.
+
+### Fixed
+- .NET projects were never detected (`.sln`/`.csproj` were compared with whole file names).
+- Scan and checkpoint ids now include microseconds so rapid successive scans keep their order.
+- Security audit: unbounded regular expressions allowed catastrophic backtracking (ReDoS) on
+  crafted input; all patterns are now bounded and oversized commands require approval.
+
+### Security
+- Raw scanner output and secret values never reach output, reports, history or hook messages.
+- Windows batch-file scanner wrappers are refused (argument injection risk).
+
+## [0.4.1] and earlier
+
+No changelog was kept before 1.0.0rc1. Version 0.4.1 provided the CLI (`doctor`, `detect`,
+`init`, `status`, `scan`), marker-based detection, safe initialization, the global policy
+document, a Gitleaks directory-scan adapter, sanitized JSON reports and the dark HTML report.

universal_dev_security-1.0.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,9 @@
+# Code of Conduct
+
+We are committed to a welcoming, respectful, and harassment-free community.
+Be respectful, assume good faith, focus on constructive technical discussion,
+accept responsibility for mistakes, and prioritize user safety and privacy.
+
+Harassment, discrimination, doxxing, threats, and publishing private
+information without permission are unacceptable. Maintainers may remove
+content or restrict participation for violations.

universal_dev_security-1.0.0/CONTRIBUTING.md

@@ -0,0 +1,36 @@
+# Contributing
+
+Thanks for your interest in Universal Dev Security.
+
+## Ground rules
+
+- Discuss substantial changes in an issue before implementing them.
+- Never include real credentials, tokens, private keys, customer data or production data.
+- Secret fixtures must be clearly fake **and assembled at runtime** (see `tests/fakes.py`) so
+  that secret scanners running on this repository do not flag the test suite.
+- Do not weaken mandatory global security policies. Policy changes need a test that shows the
+  intended decision and must keep every existing global rule at least as strict.
+- Never invent severities or scores. Map severity only from scanner data or a published standard,
+  and record the provenance in `severity_source`.
+- Never print, log or persist raw scanner output or secret values.
+- Run external programs only through `scanners.base.run_tool()` (argument list, no shell).
+- Keep regular expressions bounded; add a case to `tests/test_redos.py` for new patterns.
+
+## Development setup
+
+```bash
+python -m venv .venv
+.venv/bin/python -m pip install -e ".[dev]"     # Windows: .venv\Scripts\python
+.venv/bin/python -m pytest -q
+```
+
+Tests that need Git or Gitleaks are skipped automatically when those tools are absent; CI runs
+them with real scanners on Linux.
+
+## Pull requests
+
+Explain the problem, affected modules, test results and security implications. Add tests for new
+behavior and for every bug fix (regression test). Do not modify tests to hide implementation bugs,
+and do not claim a scan or test passed unless it was actually run.
+
+All contributions are licensed under Apache-2.0.

universal_dev_security-1.0.0/DEVELOPMENT_STATUS.md

@@ -0,0 +1,86 @@
+# Development Status
+
+**Current version:** `1.0.0` — first stable release (tag `v1.0.0`). Previous: `1.0.0rc1` GitHub pre-release.
+**Last updated:** 2026-11-14
+**Previous version:** 0.4.1 (original source archived at `dist/uds-0.4.1-original-source-backup.zip`, git-ignored)
+
+## Milestones
+
+| # | Milestone | Status | Acceptance evidence |
+|---|---|---|---|
+| 1 | Core foundation and policy engine | ✅ Complete | `test_policy.py`, `test_config.py`, `test_redaction.py` |
+| 2 | Scanner integrations | ✅ Complete (see known issue 1) | `test_scanner.py`; real Gitleaks 8.30.1, OSV-Scanner 2.7.1, Trivy 0.76.2 runs; `test_scanner_fixtures.py` from real output |
+| 3 | Unified findings schema and reporting | ✅ Complete | `test_reports.py` (schema, SARIF, escaping, CSP hash, no secrets) |
+| 4 | Dark dashboard and scan history | ✅ Complete (see known issue 4) | `test_reports.py`, `test_history.py`, end-to-end CLI test |
+| 5 | Claude Code and AI integrations | ✅ Complete — live-verified | `test_integrations.py`; live Claude Code 2.1.323 sessions (see test results) |
+| 6 | Git protection and GitHub Actions | ✅ Complete (see known issue 2) | `test_gitguard.py` incl. a real `git commit` blocked by the installed hook; workflow YAML validated |
+| 7 | Automatic fixes, testing and recovery | ✅ Complete | `test_recovery_fixes.py`; real rollback used to remove the integration from a real project without conflicts |
+| 8 | Technology profiles and compatibility | ✅ Complete | `test_detector.py` (17 technologies, nested projects, exclusions) |
+| 9 | Installer, updates and release management | ✅ Complete | `scripts/release.py` run end-to-end; `install.ps1` install + tampered-checksum rejection tested |
+| 10 | Cross-platform compatibility | ✅ Complete | GitHub Actions run 43534444713: all 12 matrix jobs (Windows/Linux/macOS × Python 3.11–3.14) passed |
+| 11 | Production readiness / release preparation | ✅ Complete | Security audit below; 1.0.0rc1 pre-release, live verification, 1.0.0 built in `dist/1.0.0/` |
+
+## Test results (actually executed)
+
+| Environment | Result |
+|---|---|
+| Windows 11, Python 3.15.2 (project `.venv`) | **196 passed, 1 skipped** (PyYAML has no Python 3.15 wheel; YAML test skipped) |
+| Windows 11, Python 3.14.7 (separate tools venv) | **197 passed** |
+| Real Gitleaks 8.30.1 | Integration tests ran (directory scan, staged, outgoing commits, hook end-to-end) |
+| Real OSV-Scanner 2.7.1 / Trivy 0.76.2 | Run through UDS on a sample vulnerable project: 29 and 16 findings, correctly normalized |
+| `scripts/release.py` | Tests ✓, self-scan ✓, sdist+wheel ✓, SHA256SUMS ✓, fresh-venv install + CLI smoke test ✓ |
+| `scripts/install.ps1` | Installs with checksum verification ✓; tampered checksum rejected, nothing installed ✓ |
+| Self-scan (`uds scan . --allow-network`) | Gitleaks, OSV-Scanner, Trivy: clean. Semgrep: not run (known issue 1) → status `incomplete` |
+| Live scan of a real Next.js project (maintainer's own) | All scanners except Semgrep ran; 0 secrets in Git-tracked files; dashboard reviewed visually by the maintainer. Revealed 4 issues (noise from `.next` caches, alarmist rotation advice for local-only secrets, severity ordering, misleading `0` for scanners that did not run) and a 5th (scope changes shown as "resolved") — all fixed with regression tests (`test_exposure.py`) |
+| Live Claude Code hook test (2.1.323, headless sessions in a throwaway repo, tools pre-allowed) | `git status` untouched; `git commit --no-verify` **denied** (`UDS: [git-hook-bypass]`); Write of a fake AWS key **denied** (`UDS: [secret-in-file]`, value not echoed); `git -C . push`, `rm -rf build`, Read `.env.*` **required approval** with UDS reasons; `git push` also stopped by the UDS `permissions.ask` rule; edits to `.claude/settings.local.json` stopped by Claude Code's own safety check first. No blocked action changed the repository. Pre-flight: hook command 16/16 in Git Bash and cmd. Finding: project hooks do not run in sessions with `CLAUDE_CODE_IGNORE_PERSISTED_TRUST` (documented) |
+| GitHub Actions (commit 760cf4b) | **13/13 jobs passed**: Windows, Ubuntu, macOS × Python 3.11, 3.12, 3.13, 3.14, plus the real-scanner job (Gitleaks 8.30.1, OSV-Scanner 2.7.1, Trivy 0.76.2, Semgrep from PyPI; tests + `uds doctor` + self-scan with `--allow-network --fail-on high`) |
+
+## Security audit (1.0.0rc1)
+
+| Check | Result |
+|---|---|
+| Exposed credentials / hardcoded secrets | Gitleaks clean on the repository; test secrets are assembled at runtime |
+| Unsafe subprocess execution | Two call sites, both argument lists with `shell=False`, validated executables, timeouts; `.bat/.cmd` scanners refused |
+| Command injection | Hook scripts embed only allow-listed interpreter paths; workflow generator validates every input; Git ranges/remotes validated |
+| Path traversal | Recovery, history and scan ids validated; identical rejection rules on all OSes (fixed during audit) |
+| Unsafe automatic fixes | Low risk only by default; checkpoint + baseline/post-change tests + automatic rollback |
+| Dependency vulnerabilities | No runtime dependencies; OSV-Scanner and Trivy clean on the repository |
+| Insecure report generation | Escaping, http(s)-only links, script-safe embedded JSON, hash-based CSP, no external resources |
+| Missing permission checks | Mandatory policy settings cannot be disabled; security-control files require approval |
+| Incomplete error handling | Fail-closed hooks; scanner errors become `error` state with suppressed output |
+| **Found and fixed:** ReDoS | Unbounded regexes took > 10 minutes on crafted input; now < 1 s (regression tests in `test_redos.py`) |
+| **Found and fixed:** HTTPS downgrade | Update check could follow redirects to HTTP; redirects are now HTTPS-only |
+
+## Known issues
+
+1. **Semgrep verified in CI only.** Semgrep could not be installed locally (PyPI network errors).
+   In CI it was installed and the self-scan (which runs Semgrep on this Python repository and fails
+   on scanner errors or high findings) passed. Its detailed output was not reviewed locally because
+   job logs and artifacts require GitHub authentication.
+2. **Generated user workflow not yet run on GitHub.** The project's own CI ran green; the
+   `uds integrate github` template is YAML-validated and mirrors the CI install steps, but has not
+   been run in a user repository.
+3. **Claude Code hook: live-verified in headless sessions only.** Interactive approval prompts were
+   not exercised (headless mode turns "ask" into a denial). The hook needs `uds` on PATH unless
+   `--python-path` is used, and runs only in workspaces Claude Code trusts.
+4. ~~Dashboard not visually reviewed~~ — reviewed by the maintainer on a real project (2026-11-14).
+5. `install.sh` is written for Linux/macOS and has not been executed.
+6. Python 3.15 is newer than some packages support (PyYAML, Semgrep wheels); UDS itself is
+   dependency-free and works on 3.11–3.15.
+7. `uds update check --source pypi` will only be meaningful once UDS is published under that name;
+   until then use `--source github:OWNER/REPO`.
+
+## Pending decisions (need maintainer approval)
+
+- Publishing the `v1.0.0` GitHub release (tag pushed; assets uploaded by the maintainer).
+- PyPI publication (not done).
+- Private vulnerability reporting is enabled (verified via API); secret-scanning push protection
+  was enabled by the maintainer but cannot be verified without repository-admin authentication.
+
+## Next development tasks
+
+1. Review the CI self-scan artifact (Semgrep findings) and run the generated workflow in a sample repository.
+2. Exercise the interactive Claude Code approval prompt once (headless verification is done).
+3. Pin GitHub Actions to commit SHAs in both workflows.
+4. Optional offline mode for OSV-Scanner (local databases) to avoid sending package metadata.
+5. Hosted web dashboard consuming report schema 2.0 (with authentication and authorization).

universal_dev_security-1.0.0/LICENSE

@@ -0,0 +1,163 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the
+copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other
+entities that control, are controlled by, or are under common control with
+that entity. For the purposes of this definition, "control" means (i) the
+power, direct or indirect, to cause the direction or management of such
+entity, whether by contract or otherwise, or (ii) ownership of fifty percent
+(50%) or more of the outstanding shares, or (iii) beneficial ownership of
+such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation source,
+and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation
+or translation of a Source form, including but not limited to compiled
+object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that
+is included in or attached to the work (an example is provided in the
+Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form,
+that is based on (or derived from) the Work and for which the editorial
+revisions, annotations, elaborations, or other modifications represent, as
+a whole, an original work of authorship. For the purposes of this License,
+Derivative Works shall not include works that remain separable from, or
+merely link (or bind by name) to the interfaces of, the Work and Derivative
+Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original
+version of the Work and any modifications or additions to that Work or
+Derivative Works thereof, that is intentionally submitted to Licensor for
+inclusion in the Work by the copyright owner or by an individual or Legal
+Entity authorized to submit on behalf of the copyright owner. For the
+purposes of this definition, "submitted" means any form of electronic,
+verbal, or written communication sent to the Licensor or its representatives,
+including but not limited to communication on electronic mailing lists,
+source code control systems, and issue tracking systems that are managed by,
+or on behalf of, the Licensor for the purpose of discussing and improving
+the Work, but excluding communication that is conspicuously marked or
+otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on
+behalf of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable (except as stated in
+this section) patent license to make, have made, use, offer to sell, sell,
+import, and otherwise transfer the Work, where such license applies only
+to those patent claims licensable by such Contributor that are necessarily
+infringed by their Contribution(s) alone or by combination of their
+Contribution(s) with the Work to which such Contribution(s) was submitted.
+If You institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work or a
+Contribution incorporated within the Work constitutes direct or contributory
+patent infringement, then any patent licenses granted to You under this
+License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and
+in Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a
+copy of this License; and
+
+(b) You must cause any modified files to carry prominent notices stating
+that You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from
+the Source form of the Work, excluding those notices that do not pertain to
+any part of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution,
+then any Derivative Works that You distribute must include a readable copy
+of the attribution notices contained within such NOTICE file, excluding
+those notices that do not pertain to any part of the Derivative Works, in
+at least one of the following places: within a NOTICE text file distributed
+as part of the Derivative Works; within the Source form or documentation,
+if provided along with the Derivative Works; or, within a display generated
+by the Derivative Works, if and wherever such third-party notices normally
+appear. The contents of the NOTICE file are for informational purposes
+only and do not modify the License. You may add Your own attribution notices
+within Derivative Works that You distribute, alongside or as an addendum
+to the NOTICE text from the Work, provided that such additional attribution
+notices cannot be construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may
+provide additional or different license terms and conditions for use,
+reproduction, or distribution of Your modifications, or for any such
+Derivative Works as a whole, provided Your use, reproduction, and
+distribution of the Work otherwise complies with the conditions stated
+in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+any Contribution intentionally submitted for inclusion in the Work by You
+to the Licensor shall be under the terms and conditions of this License,
+without any additional terms or conditions. Notwithstanding the above,
+nothing herein shall supersede or modify the terms of any separate license
+agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+names, trademarks, service marks, or product names of the Licensor, except
+as required for reasonable and customary use in describing the origin of
+the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to
+in writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
+ANY KIND, either express or implied, including, without limitation, any
+warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or
+FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining
+the appropriateness of using or redistributing the Work and assume any
+risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether
+in tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to
+in writing, shall any Contributor be liable to You for damages, including
+any direct, indirect, special, incidental, or consequential damages of any
+character arising as a result of this License or out of the use or inability
+to use the Work (including but not limited to damages for loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all other
+commercial damages or losses), even if such Contributor has been advised
+of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the
+Work or Derivative Works thereof, You may choose to offer, and charge a fee
+for, acceptance of support, warranty, indemnity, or other liability
+obligations and/or rights consistent with this License. However, in
+accepting such obligations, You may act only on Your own behalf and on
+your sole responsibility, not on behalf of any other Contributor, and only
+if You agree to indemnify, defend, and hold each Contributor harmless for
+any liability incurred by, or claims asserted against, such Contributor
+by reason of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS

universal_dev_security-1.0.0/MANIFEST.in

@@ -0,0 +1,9 @@
+include LICENSE README.md CHANGELOG.md SECURITY.md CONTRIBUTING.md CODE_OF_CONDUCT.md DEVELOPMENT_STATUS.md
+recursive-include tests *.py *.json
+recursive-include docs *.md
+recursive-include policies *.md
+recursive-include scripts *.py *.ps1 *.sh
+prune .uds
+prune .venv
+prune dist
+global-exclude __pycache__ *.py[cod]

universal_dev_security-1.0.0/PKG-INFO

@@ -0,0 +1,128 @@
+Metadata-Version: 2.4
+Name: universal-dev-security
+Version: 1.0.0
+Summary: One security system for every project: secrets, code, dependency and configuration scanning with a central policy engine, Git and AI-agent guards, and a local security dashboard.
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/jet1x/Universal-Dev-Security
+Project-URL: Repository, https://github.com/jet1x/Universal-Dev-Security.git
+Project-URL: Issues, https://github.com/jet1x/Universal-Dev-Security/issues
+Project-URL: Changelog, https://github.com/jet1x/Universal-Dev-Security/blob/main/CHANGELOG.md
+Project-URL: Security, https://github.com/jet1x/Universal-Dev-Security/blob/main/SECURITY.md
+Keywords: security,devsecops,gitleaks,semgrep,osv-scanner,trivy,sast,sca,claude-code,secrets
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Operating System :: MacOS
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Dynamic: license-file
+
+# Universal Dev Security (UDS)
+
+**One Security System. Every Project.**
+
+UDS is an open-source, local-first security toolkit for developers. It runs
+industry-standard scanners on any project, normalizes their results into one
+schema, enforces a central security policy for Git and AI coding agents, and
+produces a dark, self-contained HTML security dashboard.
+
+> **Status:** `1.0.0` — first stable release. See
+> [DEVELOPMENT_STATUS.md](DEVELOPMENT_STATUS.md) for verified functionality,
+> known issues and test results. UDS reports what its scanners find; a clean
+> result is never proof that a project is secure.
+
+## What it does
+
+| Area | Capability |
+|---|---|
+| Secrets | [Gitleaks](https://github.com/gitleaks/gitleaks) directory, staged and outgoing-commit scanning (values always redacted) |
+| Code | [Semgrep](https://semgrep.dev) static analysis with technology-based rule packs (metrics disabled) |
+| Dependencies | [OSV-Scanner](https://google.github.io/osv-scanner/) and [Trivy](https://trivy.dev) vulnerability scanning |
+| Configuration | Trivy misconfiguration scanning (Dockerfile, Kubernetes, Terraform, …) |
+| Policy | Central engine: approval for `git push`, denial of hook bypasses and secret writes, project rules can only add restrictions |
+| Git | `pre-commit` / `pre-push` hooks that block secrets (fail closed) |
+| AI agents | Claude Code `PreToolUse` hooks; generic `uds guard` JSON protocol for any agent |
+| GitHub | Generated PR workflow with checksum-verified scanners and SARIF upload |
+| Reports | JSON, SARIF 2.1.0 and an offline dark HTML dashboard with filters, history and scan comparison |
+| Recovery | Checkpoints before every UDS change; rollback that never clobbers later user edits |
+| Fixes | Low-risk, reversible fixes verified by your test suite, rolled back automatically if tests fail |
+
+Scanner states are explicit — `clean`, `findings`, `not_installed`,
+`not_applicable`, `skipped`, `error` — and the overall status becomes
+`incomplete` when an applicable scanner did not run. Severity is shown only
+when the scanner supplies it or a published scale (CVSS) defines it; everything
+else is `unclassified`. No security score is invented.
+
+## Quick start
+
+Requirements: Python 3.11+, Windows, Linux or macOS. Git is recommended.
+
+```powershell
+# Windows (from a release folder containing the wheel and SHA256SUMS)
+.\scripts\install.ps1 -Wheel .\dist\1.0.0\universal_dev_security-1.0.0-py3-none-any.whl
+```
+
+```bash
+# Linux / macOS
+sh scripts/install.sh --wheel dist/1.0.0/universal_dev_security-1.0.0-py3-none-any.whl
+```
+
+Then, inside a project:
+
+```bash
+uds doctor                 # runtime, config and scanner availability (+ official install sources)
+uds init                   # create .uds/config.toml (never overwrites)
+uds scan                   # run applicable scanners, write JSON + HTML reports, record history
+uds dashboard --open       # open the dark HTML dashboard
+uds hooks install --apply  # block secrets at commit and push time
+uds integrate claude-code --apply   # enforce the UDS policy inside Claude Code
+```
+
+Every command that changes files is a **dry run by default** and shows a diff;
+`--apply` creates a recovery checkpoint first. See [docs/installation.md](docs/installation.md)
+for scanner installation and upgrades, and [docs/commands.md](docs/commands.md) for all commands.
+
+## Documentation
+
+- [Installation and upgrades](docs/installation.md)
+- [Commands](docs/commands.md)
+- [Scanners, severity and privacy](docs/scanners.md)
+- [Integrations: Claude Code, GitHub, VS Code, other agents](docs/integrations.md)
+- [Architecture](docs/architecture.md)
+- [Security model](docs/security-model.md) and [global policy](policies/GLOBAL_SECURITY_POLICY.md)
+- [Dashboard design system](docs/dashboard-design-system.md)
+- [Release process](docs/release.md)
+
+## Safety guarantees
+
+- No telemetry. The core never contacts the network; scanners' network use is documented and
+  OSV-Scanner (which sends package names/versions to osv.dev) runs only with explicit approval.
+- UDS never installs scanners, never commits, never pushes and never publishes.
+- Existing configuration is merged, never silently overwritten; invalid files are left untouched.
+- Secret values, matched text and raw scanner output never appear in output, reports or history.
+- Global policies cannot be weakened by project configuration or AI tools.
+
+Local Git hooks and AI-agent hooks are defense in depth — keep CI scanning and
+repository-level protections (for example GitHub push protection) enabled too.
+
+## Contributing and security
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) and [SECURITY.md](SECURITY.md).
+Changes are listed in [CHANGELOG.md](CHANGELOG.md).
+
+## License
+
+Apache License 2.0. See [LICENSE](LICENSE).

universal_dev_security-1.0.0/README.md

@@ -0,0 +1,96 @@
+# Universal Dev Security (UDS)
+
+**One Security System. Every Project.**
+
+UDS is an open-source, local-first security toolkit for developers. It runs
+industry-standard scanners on any project, normalizes their results into one
+schema, enforces a central security policy for Git and AI coding agents, and
+produces a dark, self-contained HTML security dashboard.
+
+> **Status:** `1.0.0` — first stable release. See
+> [DEVELOPMENT_STATUS.md](DEVELOPMENT_STATUS.md) for verified functionality,
+> known issues and test results. UDS reports what its scanners find; a clean
+> result is never proof that a project is secure.
+
+## What it does
+
+| Area | Capability |
+|---|---|
+| Secrets | [Gitleaks](https://github.com/gitleaks/gitleaks) directory, staged and outgoing-commit scanning (values always redacted) |
+| Code | [Semgrep](https://semgrep.dev) static analysis with technology-based rule packs (metrics disabled) |
+| Dependencies | [OSV-Scanner](https://google.github.io/osv-scanner/) and [Trivy](https://trivy.dev) vulnerability scanning |
+| Configuration | Trivy misconfiguration scanning (Dockerfile, Kubernetes, Terraform, …) |
+| Policy | Central engine: approval for `git push`, denial of hook bypasses and secret writes, project rules can only add restrictions |
+| Git | `pre-commit` / `pre-push` hooks that block secrets (fail closed) |
+| AI agents | Claude Code `PreToolUse` hooks; generic `uds guard` JSON protocol for any agent |
+| GitHub | Generated PR workflow with checksum-verified scanners and SARIF upload |
+| Reports | JSON, SARIF 2.1.0 and an offline dark HTML dashboard with filters, history and scan comparison |
+| Recovery | Checkpoints before every UDS change; rollback that never clobbers later user edits |
+| Fixes | Low-risk, reversible fixes verified by your test suite, rolled back automatically if tests fail |
+
+Scanner states are explicit — `clean`, `findings`, `not_installed`,
+`not_applicable`, `skipped`, `error` — and the overall status becomes
+`incomplete` when an applicable scanner did not run. Severity is shown only
+when the scanner supplies it or a published scale (CVSS) defines it; everything
+else is `unclassified`. No security score is invented.
+
+## Quick start
+
+Requirements: Python 3.11+, Windows, Linux or macOS. Git is recommended.
+
+```powershell
+# Windows (from a release folder containing the wheel and SHA256SUMS)
+.\scripts\install.ps1 -Wheel .\dist\1.0.0\universal_dev_security-1.0.0-py3-none-any.whl
+```
+
+```bash
+# Linux / macOS
+sh scripts/install.sh --wheel dist/1.0.0/universal_dev_security-1.0.0-py3-none-any.whl
+```
+
+Then, inside a project:
+
+```bash
+uds doctor                 # runtime, config and scanner availability (+ official install sources)
+uds init                   # create .uds/config.toml (never overwrites)
+uds scan                   # run applicable scanners, write JSON + HTML reports, record history
+uds dashboard --open       # open the dark HTML dashboard
+uds hooks install --apply  # block secrets at commit and push time
+uds integrate claude-code --apply   # enforce the UDS policy inside Claude Code
+```
+
+Every command that changes files is a **dry run by default** and shows a diff;
+`--apply` creates a recovery checkpoint first. See [docs/installation.md](docs/installation.md)
+for scanner installation and upgrades, and [docs/commands.md](docs/commands.md) for all commands.
+
+## Documentation
+
+- [Installation and upgrades](docs/installation.md)
+- [Commands](docs/commands.md)
+- [Scanners, severity and privacy](docs/scanners.md)
+- [Integrations: Claude Code, GitHub, VS Code, other agents](docs/integrations.md)
+- [Architecture](docs/architecture.md)
+- [Security model](docs/security-model.md) and [global policy](policies/GLOBAL_SECURITY_POLICY.md)
+- [Dashboard design system](docs/dashboard-design-system.md)
+- [Release process](docs/release.md)
+
+## Safety guarantees
+
+- No telemetry. The core never contacts the network; scanners' network use is documented and
+  OSV-Scanner (which sends package names/versions to osv.dev) runs only with explicit approval.
+- UDS never installs scanners, never commits, never pushes and never publishes.
+- Existing configuration is merged, never silently overwritten; invalid files are left untouched.
+- Secret values, matched text and raw scanner output never appear in output, reports or history.
+- Global policies cannot be weakened by project configuration or AI tools.
+
+Local Git hooks and AI-agent hooks are defense in depth — keep CI scanning and
+repository-level protections (for example GitHub push protection) enabled too.
+
+## Contributing and security
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) and [SECURITY.md](SECURITY.md).
+Changes are listed in [CHANGELOG.md](CHANGELOG.md).
+
+## License
+
+Apache License 2.0. See [LICENSE](LICENSE).

universal_dev_security-1.0.0/SECURITY.md

@@ -0,0 +1,33 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please do **not** publish exploitable details in a public issue.
+
+- Preferred: use GitHub **private vulnerability reporting** ("Report a vulnerability" on the
+  repository's Security tab) once it is enabled.
+- Until then, open a minimal issue asking the maintainers for a private channel. Do not include
+  exploit details, credentials or private data.
+
+Please include the affected version, platform, and a minimal reproduction. We aim to acknowledge
+reports within 7 days and to agree on a disclosure timeline with the reporter.
+
+## Supported versions
+
+| Version | Supported |
+|---|---|
+| 1.0.x (including release candidates) | Yes |
+| < 1.0 | No |
+
+## Scope
+
+This policy covers UDS itself: the CLI, policy engine, hooks, integrations, report generation
+and installers. Integrated third-party scanners (Gitleaks, Semgrep, OSV-Scanner, Trivy) have
+their own security reporting processes.
+
+Particularly relevant classes of issues: secret leakage into output or reports, policy bypasses
+that let an AI agent perform an action without the required approval, command injection or
+unsafe process execution, path traversal in recovery/history, unsafe HTML in reports, and
+denial of service in pattern matching.
+
+See [docs/security-model.md](docs/security-model.md) for guarantees and known limitations.