Portfolio repository for a synthetic FastAPI product secured through a full local Product Security operating model: secure design, API controls, Terraform reference architecture, AppSec scanning, dynamic testing, finding normalisation, release assurance, vulnerability lifecycle governance, consolidated evidence, developer enablement, Security Champions, and a Repository 5 integration contract.
The application uses synthetic, non-identifiable demonstration data only. It is not a production genomics platform, is not affiliated with or endorsed by Genomics England, and does not deploy AWS resources.
This repository demonstrates how product-security practices can be implemented as reproducible engineering workflows rather than slideware. The core product is intentionally small so the security system around it is inspectable end to end.
The reference product is a Genomic Research Access API with dataset catalogue, access request workflow, approval and rejection actions, structured audit events, local JWT authentication, role-based permissions, and object-level authorisation.
- 14 documented milestones completed.
- 25 product-security capabilities mapped to evidence.
- 44 canonical findings under deterministic ownership, release and lifecycle governance.
- 46 source findings preserved with source lineage.
- 178 integration lineage edges exported for downstream validation.
- 9 consolidated evidence domains verified locally.
All assurance evidence is generated locally from repository files, local tests, local scanner wrappers, and deterministic timestamps. AWS architecture is Terraform reference code only. Repository 5 integration is a contract export only and does not modify another repository.
Start with:
- Application Architecture
- AWS Reference Architecture
- Portfolio Diagrams
- Product Security Operating Model
The secure SDLC is represented as runnable local commands, policy files, CI workflows and generated evidence. The final validation target is:
make final-validationSTRIDE threat model artefacts live under docs/threat-model. They include assets, actors, trust boundaries, data flows, threat register, requirements, traceability and residual risk.
Authentication, authorisation, object access, security headers, CORS and audit behaviour are covered by local tests and evidence under outputs/security/api-security/.
Terraform under infrastructure models ECS Fargate, ALB, VPC, DynamoDB, KMS, Secrets Manager metadata, ECR, CloudTrail and observability controls. It is intentionally not applied.
Milestone 5 added Gitleaks, Semgrep, Bandit, pip-audit, CycloneDX SBOM, Checkov, Docker image build validation and Trivy container scanning through pinned wrappers and governed evidence.
Dynamic validation includes local pytest boundary tests, Schemathesis OpenAPI checks and OWASP ZAP local scans. Dynamic targets are restricted to localhost and approved local Docker usage.
Scanner, threat-model, infrastructure and dynamic findings are normalised into canonical findings with deterministic IDs, owners, SLAs, risk scores and suppression governance.
Release gates evaluate canonical findings and produce deterministic decisions, rule evaluations, approvals and action lists. Current local decision is conditional_pass.
Lifecycle governance provides triage states, exception approval, expiry handling, verification-before-closure and audit reports. It is local and does not integrate with ticketing systems.
Consolidated evidence lives under outputs/security/evidence/. Reports live under reports/security/ and reports/portfolio/.
Developer guidance, security checklists and local workflow instructions live under docs/developer-security.
The Security Champions programme lives under security-champions, including charter, roles, workshops, exercises, metrics and continuity guidance.
The Repository 5 contract export lives under docs/integration and outputs/security/integration/. It is compatible, versioned and validated locally, but performs no live ingestion.
Recruiter, engineering manager and security reviewer views are under docs/portfolio. Start with:
Generate portfolio evidence and reports:
make portfolio-fullKey outputs:
outputs/security/portfolio/portfolio-summary.jsonoutputs/security/portfolio/security-capability-matrix.jsonoutputs/security/portfolio/portfolio-manifest.jsonoutputs/portfolio/reports/portfolio/
Requires Python 3.11 or later.
make setup
make runOpen http://127.0.0.1:8000/docs for the local OpenAPI UI.
make format-check
make lint
make type-check
make test-coverage
make qualitymake appsec-full
make dynamic-full
make findings-full
make release-full
make lifecycle-full
make evidence-full
make integration-full
make security-assurance-fullmake final-validation
git diff --check
git status --shortfinal-validation verifies quality, existing evidence manifests, integration evidence and portfolio evidence. Docker-backed AppSec commands remain separate because they depend on local Docker availability.
Repository governance is documented in LICENSE, SECURITY.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, and .github/repository-metadata.md.
The repository intentionally excludes production deployment, AWS resource creation, live identity-provider integration, ticketing integrations, dashboards, messaging integrations, regulatory certification and changes to Repository 5. See limitations and residual risk.