Fix final Bandit AppSec findings

Author: Ibraheem Olasupo

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help setup install format format-check lint type-check test test-coverage auth-test api-security-test terraform-fmt terraform-fmt-check terraform-init terraform-validate terraform-test infrastructure-test infrastructure-evidence verify-infrastructure-evidence infrastructure-report security-tools secrets-scan sast sast-semgrep sast-bandit semgrep-test sca dependency-audit sbom verify-sbom iac-scan checkov-scan container-build-security container-scan appsec-fast appsec-full appsec-evidence verify-appsec-evidence appsec-report dynamic-tools dynamic-server-start dynamic-server-wait dynamic-server-stop dynamic-diagnostics schemathesis-test api-schema-security-test zap-baseline zap-api-scan auth-boundary-test authorisation-boundary-test object-access-test input-mutation-test security-header-test cors-test resource-consumption-test audit-dynamic-test dast dynamic-evidence verify-dynamic-evidence dynamic-report dynamic-pytest dynamic-fast dynamic-full findings-normalise findings-deduplicate findings-enrich findings-validate findings-evidence verify-findings-evidence findings-report findings-full release-policy-validate release-gate-evaluate release-gate-enforce release-evidence verify-release-evidence release-report release-full lifecycle-policy-validate lifecycle-initialise lifecycle-validate lifecycle-expiry lifecycle-evidence verify-lifecycle-evidence lifecycle-report lifecycle-full evidence-source-validate evidence-aggregate evidence-generate verify-consolidated-evidence evidence-report evidence-full integration-policy-validate integration-export integration-validate verify-integration-evidence integration-report integration-full portfolio-evidence verify-portfolio-evidence portfolio-report portfolio-full final-validation security-assurance-full security-doctor developer-docs-validate developer-enablement-evidence verify-developer-enablement-evidence developer-enablement-report developer-enablement-full champions-policy-validate champions-metrics champions-evidence verify-champions-evidence champions-report champions-full pre-commit-install pre-commit-run quality run docker-build docker-run threat-model-validate threat-model-evidence verify-threat-model-evidence threat-model-report api-security-evidence verify-api-security-evidence api-security-report dev-token-researcher dev-token-approver dev-token-auditor clean
+.PHONY: help setup install format format-check lint type-check test test-coverage auth-test api-security-test terraform-fmt terraform-fmt-check terraform-init terraform-validate terraform-test infrastructure-test infrastructure-evidence verify-infrastructure-evidence infrastructure-report security-tools secrets-scan sast sast-semgrep sast-bandit bandit semgrep-test sca dependency-audit sbom verify-sbom iac-scan checkov-scan container-build-security container-scan appsec-fast appsec-full appsec-evidence verify-appsec-evidence appsec-report dynamic-tools dynamic-server-start dynamic-server-wait dynamic-server-stop dynamic-diagnostics schemathesis-test api-schema-security-test zap-baseline zap-api-scan auth-boundary-test authorisation-boundary-test object-access-test input-mutation-test security-header-test cors-test resource-consumption-test audit-dynamic-test dast dynamic-evidence verify-dynamic-evidence dynamic-report dynamic-pytest dynamic-fast dynamic-full findings-normalise findings-deduplicate findings-enrich findings-validate findings-evidence verify-findings-evidence findings-report findings-full release-policy-validate release-gate-evaluate release-gate-enforce release-evidence verify-release-evidence release-report release-full lifecycle-policy-validate lifecycle-initialise lifecycle-validate lifecycle-expiry lifecycle-evidence verify-lifecycle-evidence lifecycle-report lifecycle-full evidence-source-validate evidence-aggregate evidence-generate verify-consolidated-evidence evidence-report evidence-full integration-policy-validate integration-export integration-validate verify-integration-evidence integration-report integration-full portfolio-evidence verify-portfolio-evidence portfolio-report portfolio-full final-validation security-assurance-full security-doctor developer-docs-validate developer-enablement-evidence verify-developer-enablement-evidence developer-enablement-report developer-enablement-full champions-policy-validate champions-metrics champions-evidence verify-champions-evidence champions-report champions-full pre-commit-install pre-commit-run quality run docker-build docker-run threat-model-validate threat-model-evidence verify-threat-model-evidence threat-model-report api-security-evidence verify-api-security-evidence api-security-report dev-token-researcher dev-token-approver dev-token-auditor clean
 
 PYTHON ?= python3
 VENV ?= .venv
@@ -88,6 +88,8 @@ semgrep-test:
 sast-bandit:
 	PYTHONPATH=src $(PYTHON) scripts/appsec_tools.py bandit
 
+bandit: sast-bandit
+
 sast: sast-semgrep sast-bandit
 
 dependency-audit:

outputs/portfolio/evidence-index.json

@@ -21,7 +21,7 @@
     },
     {
       "path": "outputs/security/appsec/evidence-manifest.json",
-      "sha256": "2ebf280b426e6b1218a2bbe3df1e0a08ee6c374297a941b2e29b947ed4bce6db",
+      "sha256": "c1784aa63d05fadc212c96e2328e8545641750bfaf9cf19ea828319706c12e3e",
       "size_bytes": 3564,
       "type": "evidence"
     },
@@ -33,25 +33,25 @@
     },
     {
       "path": "outputs/security/findings/evidence-manifest.json",
-      "sha256": "89a45b47a1611411903cccadd3923d32c65e497f523a8cb7f35e507dd5c5b164",
+      "sha256": "99dab00b283f084a7b46163d5b335b717f6a8d0ee66daa2518361f287936ad43",
       "size_bytes": 7093,
       "type": "evidence"
     },
     {
       "path": "outputs/security/release/evidence-manifest.json",
-      "sha256": "e5f744c5f4af2fe0dac908f76ade8a5e3a245410df081fb73cad9d50733b3d7e",
+      "sha256": "a8d7fa101be2c4c34c2df64f19db2003846301c1408ba386bfe809e2e2e11f3d",
       "size_bytes": 3296,
       "type": "evidence"
     },
     {
       "path": "outputs/security/lifecycle/evidence-manifest.json",
-      "sha256": "d24ac2f6349b6b8fc8ebb6b59c5716627d4e0c6346ccf8053d0e30b822e72493",
+      "sha256": "3448f4a3a299d6e4ef3cb210ee4bc6222eeda2ce8279b58873233c1a326c4928",
       "size_bytes": 5829,
       "type": "evidence"
     },
     {
       "path": "outputs/security/evidence/evidence-manifest.json",
-      "sha256": "459a9f1b6e74acd40d0d3126a24a85e240babe397a6c7cc123b106fea15e13cb",
+      "sha256": "dfd3c89a72bfdf3f8b16566a3e5555188548baf04ed3342cac667d19d6bb1556",
       "size_bytes": 6527,
       "type": "evidence"
     },
@@ -63,7 +63,7 @@
     },
     {
       "path": "outputs/security/integration/integration-manifest.json",
-      "sha256": "b677d155023b952c7161a9b427ff9ce5829ce3a3094d262d03a5240f6fb66d39",
+      "sha256": "7a0b810da145b019c21335b100b0ea6df35b38fcf341a27a1fcdaffb7bb68286",
       "size_bytes": 4620,
       "type": "evidence"
     }

outputs/portfolio/portfolio-manifest.json

@@ -14,7 +14,7 @@
   ],
   "git": {
     "branch": "main",
-    "commit": "291b722fbb9f",
+    "commit": "671e16eb5e64",
     "dirty": "true"
   },
   "input_files": {
@@ -38,7 +38,7 @@
   "output_files": {
     "evidence-index.json": {
       "path": "outputs/security/portfolio/evidence-index.json",
-      "sha256": "eb258d0eb6e09eeb95576ed72a0d8f72e28420a6ab62b690697cd3a01d2db99a",
+      "sha256": "40afaf332ed487c23878b1757f8040f1f1284fd63d9667c94d389a8fec09adf2",
       "size_bytes": 2487
     },
     "milestone-completion.json": {
@@ -58,12 +58,12 @@
     },
     "portfolio-summary.json": {
       "path": "outputs/security/portfolio/portfolio-summary.json",
-      "sha256": "86fba629fa70166a52b23f63d4d64ef5ff3acbcb7e3a35008ad5ed000367ba10",
+      "sha256": "5faa2be9551996d92b03d35a888dc38ab5c030794a998718d2b993b9fc812fe4",
       "size_bytes": 930
     },
     "report-index.json": {
       "path": "outputs/security/portfolio/report-index.json",
-      "sha256": "1683983d39181e3638406efabce61dbe2109bfb6d926b21f056e7ae0d1dfe54c",
+      "sha256": "c68b7b1fb867c7d4ae91dc966f5ad0f14f4b87bb80735b12978fc59a3051e447",
       "size_bytes": 3239
     },
     "security-capability-matrix.json": {
@@ -72,6 +72,6 @@
       "size_bytes": 7933
     }
   },
-  "portfolio_id": "PF-cefdf2bb034a027b",
+  "portfolio_id": "PF-738ab5a1de9b8db7",
   "schema_version": "1.0"
 }

outputs/portfolio/portfolio-summary.json

@@ -6,7 +6,7 @@
   "deployment_status": "not_deployed",
   "evidence_sources": 11,
   "milestones_completed": 14,
-  "portfolio_id": "PF-cefdf2bb034a027b",
+  "portfolio_id": "PF-738ab5a1de9b8db7",
   "portfolio_package": "outputs/portfolio",
   "project_name": "DevSecOps Application Security Pipeline",
   "readiness_limitations": [

outputs/portfolio/report-index.json

@@ -3,43 +3,43 @@
   "items": [
     {
       "path": "reports/portfolio/final-project-report.md",
-      "sha256": "a8c563051020c78c5961f84cc8fab0012194c7b9ca725e539803ff481d34fe3a",
+      "sha256": "2154db968fad1743b00743f6072409f8dd2be878a6f32490df42598417e02a4e",
       "size_bytes": 712,
       "type": "report"
     },
     {
       "path": "reports/portfolio/final-security-assurance-report.md",
-      "sha256": "665fdc98567f9f41c40dde56d848d9933d74e10f59062fa0a7982238212f4f3b",
+      "sha256": "8dc9aa4c2b3f450c9b908451bcc4b5b21abc8d29c6182778e9b08bc26185f8eb",
       "size_bytes": 723,
       "type": "report"
     },
     {
       "path": "reports/portfolio/final-architecture-report.md",
-      "sha256": "7e1a47dbf202c7f8d10e65b4a3cfe7f6ef86e857317ad6a867fdff2f528abe4f",
+      "sha256": "ec6e745fab63fc35d2c7b9dd3aca7c5b5e2517a9e5b3e95c32c83de9c950ecfa",
       "size_bytes": 717,
       "type": "report"
     },
     {
       "path": "reports/portfolio/final-testing-report.md",
-      "sha256": "c0232e79fc96ab7a96b36557c1cccb0d1c90585344cd03505841903061cae02d",
+      "sha256": "b3b39ae0e5472c743611c864eae211c0d84520ab1b586e78e5d79cb05b8bd404",
       "size_bytes": 712,
       "type": "report"
     },
     {
       "path": "reports/portfolio/final-evidence-report.md",
-      "sha256": "0303b478f24573df00f4ac675c378f1afbc127e6bf00f43cfd30317172a57bda",
+      "sha256": "880bcff319e03bf2aa62e3cb5ba8cc539be60a2df4e4e87939c20f2918552899",
       "size_bytes": 713,
       "type": "report"
     },
     {
       "path": "reports/portfolio/final-limitations-report.md",
-      "sha256": "447398bf0bb58c87d4a297002c65b663cf834a898b401455be97b4c792232a4b",
+      "sha256": "8d99fff4c1f243e2900fe8122296581e107e0b75b4b920f07e0e3f3ccd759e6e",
       "size_bytes": 716,
       "type": "report"
     },
     {
       "path": "reports/portfolio/final-portfolio-readiness-report.md",
-      "sha256": "03b3b54a11e785c0fb8b0275eae33b25e899ae528249c51dae14673dbb7a31c7",
+      "sha256": "1fd814d84bdabd7389522c2b64e6ecd5eeab4cd7e00f22d6ebd7b775792a7a27",
       "size_bytes": 724,
       "type": "report"
     },
@@ -51,13 +51,13 @@
     },
     {
       "path": "reports/security/security-evidence-report.md",
-      "sha256": "1ad50977bf8a34765b1c0aeec9b328fa30ee1af1e4b41a643e1e364cd73c2bf7",
+      "sha256": "166edd7363b9b5f5f756a7173ce754e8eb1b3ed155037c51b16a457eb73dbf11",
       "size_bytes": 260,
       "type": "report"
     },
     {
       "path": "reports/security/portfolio-assurance-report.md",
-      "sha256": "3eed3da621a0240e94729841111777c74326e477a10db90716dd88a1e29e7f86",
+      "sha256": "f4042ed181cc3800dec87098643b7fbd7cbd69a5a83c06b9a20784df9ca11f8a",
       "size_bytes": 178,
       "type": "report"
     },
@@ -75,7 +75,7 @@
     },
     {
       "path": "reports/security/release-gate-report.md",
-      "sha256": "45cc72bfe82f57d8eaba8a93bfdf0965087bc21f0d676922e547d04a9e10d656",
+      "sha256": "7e5c61a63f78f493bc713a4e08bffac2c06b1f834c7c55a2e1b6a06cc48a54e6",
       "size_bytes": 8502,
       "type": "report"
     },

outputs/portfolio/reports/final-architecture-report.md

@@ -1,6 +1,6 @@
 # Final Architecture Report
 
-Portfolio ID: `PF-cefdf2bb034a027b`
+Portfolio ID: `PF-738ab5a1de9b8db7`
 
 Readiness status: `ready_with_limitations`
 

outputs/portfolio/reports/final-evidence-report.md

@@ -1,6 +1,6 @@
 # Final Evidence Report
 
-Portfolio ID: `PF-cefdf2bb034a027b`
+Portfolio ID: `PF-738ab5a1de9b8db7`
 
 Readiness status: `ready_with_limitations`
 

outputs/portfolio/reports/final-project-report.md

@@ -1,6 +1,6 @@
 # Final Project Report
 
-Portfolio ID: `PF-cefdf2bb034a027b`
+Portfolio ID: `PF-738ab5a1de9b8db7`
 
 Readiness status: `ready_with_limitations`
 

outputs/portfolio/reports/final-security-assurance-report.md

@@ -1,6 +1,6 @@
 # Final Security Assurance Report
 
-Portfolio ID: `PF-cefdf2bb034a027b`
+Portfolio ID: `PF-738ab5a1de9b8db7`
 
 Readiness status: `ready_with_limitations`
 

outputs/portfolio/reports/final-testing-report.md

@@ -1,6 +1,6 @@
 # Final Testing Report
 
-Portfolio ID: `PF-cefdf2bb034a027b`
+Portfolio ID: `PF-738ab5a1de9b8db7`
 
 Readiness status: `ready_with_limitations`