Under Construction

1
from dataclasses import dataclass
2
from typing import Optional
3

4
@dataclass
5
class Finding:
6
    severity: str
7
    description: str
8
    cwe: Optional[int] = None
9

10
    def is_critical(self) -> bool:
11
        return self.severity in ("critical", "high")
12

13
findings = [
14
    Finding("critical", "SQL injection in login handler", cwe=89),
15
    Finding("low", "Missing rate limiting on /api/health"),
16
]
17

18
for f in findings:
19
    if f.is_critical():
20
        print(f"[!] {f.description} (CWE-{f.cwe})")

1
package main
2

3
import (
4
  "fmt"
5
  "net/http"
6
  "time"
7
)
8

9
func authMiddleware(next http.Handler) http.Handler {
10
  return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
11
    token := r.Header.Get("Authorization")
12
    if token == "" {
13
      http.Error(w, "unauthorized", http.StatusUnauthorized)
14
      return
15
    }
16
    next.ServeHTTP(w, r)
17
  })
18
}
19

20
func main() {
21
  mux := http.NewServeMux()
22
  mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
23
    fmt.Fprintf(w, "ok at %s", time.Now().Format(time.RFC3339))
24
  })
25

26
  srv := &http.Server{
27
    Addr:         ":8080",
28
    Handler:      authMiddleware(mux),
29
    ReadTimeout:  5 * time.Second,
30
    WriteTimeout: 10 * time.Second,
31
  }
32
  srv.ListenAndServe()
33
}

1
use std::collections::HashMap;
2

3
#[derive(Debug)]
4
struct ScanResult {
5
    target: String,
6
    findings: Vec<String>,
7
}
8

9
fn scan_targets(targets: &[&str]) -> Vec<ScanResult> {
10
    targets
11
        .iter()
12
        .map(|t| ScanResult {
13
            target: t.to_string(),
14
            findings: run_checks(t),
15
        })
16
        .filter(|r| !r.findings.is_empty())
17
        .collect()
18
}
19

20
fn run_checks(target: &str) -> Vec<String> {
21
    let mut results = Vec::new();
22
    if !target.starts_with("https://") {
23
        results.push("TLS not enforced".into());
24
    }
25
    results
26
}

1
#!/usr/bin/env bash
2
set -euo pipefail
3

4
REPO_ROOT="$(git rev-parse --show-toplevel)"
5
SCAN_DIR="${1:-$REPO_ROOT}"
6

7
echo "[*] Scanning $SCAN_DIR for secrets..."
8

9
if ! command -v gitleaks &>/dev/null; then
10
    echo "[!] gitleaks not installed" >&2
11
    exit 1
12
fi
13

14
gitleaks detect \
15
    --source="$SCAN_DIR" \
16
    --report-format=json \
17
    --report-path="$REPO_ROOT/gitleaks-report.json" \
18
    --verbose
19

20
FINDINGS=$(jq length "$REPO_ROOT/gitleaks-report.json")
21
echo "[*] Found $FINDINGS potential secrets"

1
name: Security Scan
2
on:
3
  pull_request:
4
    branches: [main]
5

6
jobs:
7
  gitleaks:
8
    runs-on: ubuntu-latest
9
    permissions:
10
      contents: read
11
    steps:
12
      - uses: actions/checkout@v4
13
        with:
14
          fetch-depth: 0
15

16
      - uses: gitleaks/gitleaks-action@v2
17
        env:
18
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

1
resource "aws_wafv2_web_acl" "api_protection" {
2
  name  = "api-waf"
3
  scope = "REGIONAL"
4

5
  default_action {
6
    allow {}
7
  }
8

9
  rule {
10
    name     = "rate-limit"
11
    priority = 1
12

13
    action {
14
      block {}
15
    }
16

17
    statement {
18
      rate_based_statement {
19
        limit              = 2000
20
        aggregate_key_type = "IP"
21
      }
22
    }
23

24
    visibility_config {
25
      sampled_requests_enabled   = true
26
      cloudwatch_metrics_enabled = true
27
      metric_name                = "api-rate-limit"
28
    }
29
  }
30

31
  visibility_config {
32
    sampled_requests_enabled   = true
33
    cloudwatch_metrics_enabled = true
34
    metric_name                = "api-waf"
35
  }
36
}

1
interface SecurityHeader {
2
  name: string;
3
  value: string;
4
  required: boolean;
5
}
6

7
const SECURITY_HEADERS: SecurityHeader[] = [
8
  { name: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains", required: true },
9
  { name: "X-Content-Type-Options", value: "nosniff", required: true },
10
  { name: "X-Frame-Options", value: "DENY", required: true },
11
  { name: "Content-Security-Policy", value: "default-src 'self'", required: false },
12
];
13

14
function audit(headers: Record<string, string>): string[] {
15
  return SECURITY_HEADERS
16
    .filter((h) => h.required && !headers[h.name.toLowerCase()])
17
    .map((h) => `Missing required header: ${h.name}`);
18
}