security-scan-report

Security Scan Report

Usage: /security-scan-report or /security-scan-report --detailed

Purpose: Run security scans and generate comprehensive security report

---

🔒 What This Command Does

Executes multiple security scanning tools and consolidates results:

1. Bandit - Python security linter
2. Safety - Dependency vulnerability checker (if configured)
3. Secrets detection - Check for exposed credentials
4. Dependency audit - Check for known CVEs

---

📊 Execution Steps

Step 1: Run Security Scans

Execute security scanning via Makefile:

# Run all security checks
make security-check

# Individual scans
bandit -r src/ -f json -o /tmp/bandit_report.json
bandit -r src/ -ll  # Low/Medium/High severity

# Check dependencies (if safety installed)
safety check --json || echo "Safety not configured"

# Check for secrets in code
git secrets --scan || echo "Git secrets not configured"

Step 2: Parse Results

Analyze findings from each scanner:

# Parse Bandit JSON output
if [ -f /tmp/bandit_report.json ]; then
    jq '.results[] | {severity, confidence, test_id, issue_text, filename, line_number}' \
       /tmp/bandit_report.json
fi

# Count by severity
CRITICAL=$(jq '[.results[] | select(.severity=="CRITICAL")] | length' /tmp/bandit_report.json)
HIGH=$(jq '[.results[] | select(.severity=="HIGH")] | length' /tmp/bandit_report.json)
MEDIUM=$(jq '[.results[] | select(.severity=="MEDIUM")] | length' /tmp/bandit_report.json)
LOW=$(jq '[.results[] | select(.severity=="LOW")] | length' /tmp/bandit_report.json)

Step 3: Categorize Issues

Group findings by category:

Code Security:

• SQL injection risks
• XSS vulnerabilities
• Command injection
• Path traversal
• Insecure crypto

Dependency Security:

• Known CVEs
• Outdated packages
• Vulnerable versions

Configuration Security:

• Hardcoded secrets
• Weak crypto algorithms
• Insecure defaults

Step 4: Generate Report

Create comprehensive security report: