Skip to content

Commit ea79556

Browse files
authored
Merge pull request #35 from devatsecure/claude/add-security-testing-guide-BClsS
Add continuous autonomous security testing framework (v3.0)
2 parents b027a17 + c235c1e commit ea79556

17 files changed

+6596
-3
lines changed

.claude/rules/development.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,12 @@ Argus-Security/
5050
│ ├── agent_personas.py # Phase 3: Multi-agent review
5151
│ ├── sandbox_validator.py # Phase 4: Docker validation
5252
│ ├── remediation_engine.py # Auto-fix generation
53+
│ ├── diff_impact_analyzer.py # Diff-intelligent scanner scoping
54+
│ ├── agent_chain_discovery.py # LLM-powered attack chain discovery
55+
│ ├── autofix_pr_generator.py # AutoFix PR generation + closed loop
56+
│ ├── findings_store.py # SQLite cross-scan findings store
57+
│ ├── app_context_builder.py # Unified application context model
58+
│ ├── sast_dast_validator.py # SAST-to-DAST live validation
5359
│ └── argus # CLI entry point
5460
├── policy/rego/ # Phase 5: OPA policies
5561
├── profiles/ # Config profiles

.claude/rules/features.md

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
description: Advanced feature modules and their configuration toggles
3-
globs: ["scripts/error_classifier.py", "scripts/audit_trail.py", "scripts/phase_gate.py", "scripts/mcp_server.py", "scripts/dast_auth_config.py", "scripts/temporal_orchestrator.py", "scripts/license_risk_scorer.py", "scripts/epss_scorer.py", "scripts/fix_version_tracker.py", "scripts/vex_processor.py", "scripts/vuln_deduplicator.py", "scripts/advanced_suppression.py", "scripts/compliance_mapper.py"]
3+
globs: ["scripts/error_classifier.py", "scripts/audit_trail.py", "scripts/phase_gate.py", "scripts/mcp_server.py", "scripts/dast_auth_config.py", "scripts/temporal_orchestrator.py", "scripts/license_risk_scorer.py", "scripts/epss_scorer.py", "scripts/fix_version_tracker.py", "scripts/vex_processor.py", "scripts/vuln_deduplicator.py", "scripts/advanced_suppression.py", "scripts/compliance_mapper.py", "scripts/diff_impact_analyzer.py", "scripts/agent_chain_discovery.py", "scripts/autofix_pr_generator.py", "scripts/findings_store.py", "scripts/app_context_builder.py", "scripts/sast_dast_validator.py"]
44
---
55

66
# Advanced Features
@@ -43,3 +43,23 @@ Multi-key: {VulnID, PkgName, Version, Path}. Cross-scanner merge. Strategies: au
4343

4444
## Compliance Mapping (`scripts/compliance_mapper.py`)
4545
NIST 800-53, PCI DSS 4.0, OWASP Top 10, SOC 2, CIS K8s, ISO 27001. CWE-based mapping + category fallback. Toggle: `enable_compliance_mapping=True`
46+
47+
# Continuous Security Testing (v3.0)
48+
49+
## Diff-Intelligent Scanner Scoping (`scripts/diff_impact_analyzer.py`)
50+
Classifies changed files by security relevance (skip docs/assets, always scan auth/crypto/config). Expands blast radius via reverse dependency lookup — if auth middleware changed, finds all files importing it. Generates Semgrep `--include` args for scoped scanning. Toggle: `enable_diff_scoping=True`, `diff_expand_impact_radius=True`
51+
52+
## Agent-Driven Chain Discovery (`scripts/agent_chain_discovery.py`)
53+
LLM-powered multi-step attack chain discovery beyond rule-based patterns. Sends findings to LLM to reason about cross-component exploitation paths. Cross-component analyzer detects dangerous finding combinations across architectural boundaries (auth+api, models+api, middleware+routes). Toggle: `enable_agent_chain_discovery=False` (opt-in), `enable_cross_component_analysis=True`
54+
55+
## AutoFix PR Generator (`scripts/autofix_pr_generator.py`)
56+
Generates git branches with applied fixes from RemediationEngine suggestions. Creates conventional-commit-style messages, formatted PR bodies with diff/CWE/testing sections. ClosedLoopOrchestrator wires find→fix→verify into a single flow. Toggle: `enable_autofix_pr=False` (opt-in), `autofix_confidence_threshold="high"`, `autofix_max_prs_per_scan=5`
57+
58+
## Persistent Findings Store (`scripts/findings_store.py`)
59+
SQLite-backed cross-scan intelligence. Tracks findings across scans via content-based fingerprinting. Detects regressions (previously-fixed findings reappearing), computes MTTF, FP rates, severity trending. Injects historical context into LLM enrichment prompts. Toggle: `enable_findings_store=True`, `findings_db_path=".argus/findings.db"`, `inject_historical_context=True`
60+
61+
## Application Context Builder (`scripts/app_context_builder.py`)
62+
Detects framework (Django/Flask/Express/Spring/etc.), language, auth mechanism (JWT/OAuth2/session), cloud provider, IaC files, middleware chain, entry points, and OpenAPI specs. Generates `to_prompt_context()` string for LLM prompt injection. Toggle: `enable_app_context=True`
63+
64+
## SAST-to-DAST Live Validation (`scripts/sast_dast_validator.py`)
65+
Validates SAST findings against live deployment targets. Maps vuln types to HTTP test payloads (SQLi, XSS, SSRF, path traversal, command injection, IDOR). Safety: rejects production targets by default, only allows staging/preview/development. Toggle: `enable_live_validation=False` (opt-in), `live_validation_environment="staging"`

.github/workflows/argus-retest.yml

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
name: Argus Retest After Fix
2+
on:
3+
pull_request:
4+
types: [closed]
5+
6+
jobs:
7+
retest:
8+
# Only run when an argus/fix- PR is merged
9+
if: >
10+
github.event.pull_request.merged == true &&
11+
startsWith(github.event.pull_request.head.ref, 'argus/fix-')
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
pull-requests: write
16+
17+
steps:
18+
- uses: actions/checkout@v4
19+
with:
20+
fetch-depth: 0
21+
22+
- name: Set up Python
23+
uses: actions/setup-python@v5
24+
with:
25+
python-version: '3.11'
26+
27+
- name: Install dependencies
28+
run: pip install -r requirements.txt
29+
30+
- name: Extract fix metadata
31+
id: meta
32+
run: |
33+
BRANCH="${{ github.event.pull_request.head.ref }}"
34+
# Extract vuln type and finding ID from branch name: argus/fix-{type}-{id}
35+
VULN_TYPE=$(echo "$BRANCH" | sed 's|argus/fix-||' | sed 's|-[a-f0-9]*$||')
36+
FINDING_ID=$(echo "$BRANCH" | grep -oP '[a-f0-9]{8}$' || echo "unknown")
37+
echo "vuln_type=$VULN_TYPE" >> $GITHUB_OUTPUT
38+
echo "finding_id=$FINDING_ID" >> $GITHUB_OUTPUT
39+
# Get changed files from the PR
40+
CHANGED_FILES=$(gh pr view ${{ github.event.pull_request.number }} --json files -q '.files[].path' || echo "")
41+
echo "changed_files=$CHANGED_FILES" >> $GITHUB_OUTPUT
42+
env:
43+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
44+
45+
- name: Run regression tests
46+
id: regression
47+
continue-on-error: true
48+
run: |
49+
python -c "
50+
import sys
51+
sys.path.insert(0, 'scripts')
52+
try:
53+
from regression_tester import RegressionTester
54+
tester = RegressionTester()
55+
results = tester.run('tests/security_regression')
56+
passed = results.get('passed', 0)
57+
failed = results.get('failed', 0)
58+
print(f'Regression tests: {passed} passed, {failed} failed')
59+
sys.exit(1 if failed > 0 else 0)
60+
except Exception as e:
61+
print(f'Regression test error: {e}')
62+
sys.exit(1)
63+
"
64+
65+
- name: Run targeted SAST rescan
66+
id: rescan
67+
continue-on-error: true
68+
env:
69+
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
70+
run: |
71+
python scripts/run_ai_audit.py \
72+
--project-type auto \
73+
--only-changed \
74+
--review-type security
75+
76+
- name: Update finding status
77+
if: steps.regression.outcome == 'success' && steps.rescan.outcome == 'success'
78+
run: |
79+
python -c "
80+
import sys
81+
sys.path.insert(0, 'scripts')
82+
try:
83+
from findings_store import FindingsStore
84+
store = FindingsStore()
85+
store.record_fix(
86+
finding_id='${{ steps.meta.outputs.finding_id }}',
87+
fix_commit='${{ github.sha }}',
88+
fix_method='autofix',
89+
retest_passed=True,
90+
)
91+
print('Finding marked as fix-verified')
92+
except Exception as e:
93+
print(f'Could not update findings store: {e}')
94+
"
95+
96+
- name: Post retest results
97+
if: always()
98+
uses: actions/github-script@v7
99+
with:
100+
script: |
101+
const regression = '${{ steps.regression.outcome }}';
102+
const rescan = '${{ steps.rescan.outcome }}';
103+
const allPassed = regression === 'success' && rescan === 'success';
104+
105+
const body = `## Argus Retest Results
106+
107+
| Check | Status |
108+
|-------|--------|
109+
| Regression Tests | ${regression === 'success' ? 'Passed' : 'Failed'} |
110+
| SAST Rescan | ${rescan === 'success' ? 'Clean' : 'Issues found'} |
111+
| **Overall** | **${allPassed ? 'Fix Verified' : 'Needs Review'}** |
112+
113+
${allPassed ? 'The fix has been verified. The vulnerability is confirmed resolved.' : 'The retest found issues. Please review the scan results.'}
114+
115+
---
116+
*Argus Security Retest — triggered by merge of \`${{ github.event.pull_request.head.ref }}\`*`;
117+
118+
// Comment on the merged PR
119+
await github.rest.issues.createComment({
120+
owner: context.repo.owner,
121+
repo: context.repo.repo,
122+
issue_number: ${{ github.event.pull_request.number }},
123+
body: body
124+
});
Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
name: Post-Deploy Security Validation
2+
on:
3+
deployment_status:
4+
# Trigger when deployment succeeds
5+
workflow_dispatch:
6+
inputs:
7+
target_url:
8+
description: 'Deployment URL to scan'
9+
required: false
10+
type: string
11+
environment:
12+
description: 'Deployment environment'
13+
required: false
14+
default: 'staging'
15+
type: string
16+
17+
jobs:
18+
post-deploy-scan:
19+
if: >
20+
github.event_name == 'workflow_dispatch' ||
21+
github.event.deployment_status.state == 'success'
22+
runs-on: ubuntu-latest
23+
permissions:
24+
contents: read
25+
security-events: write
26+
27+
steps:
28+
- uses: actions/checkout@v4
29+
with:
30+
fetch-depth: 0
31+
32+
- name: Set up Python
33+
uses: actions/setup-python@v5
34+
with:
35+
python-version: '3.11'
36+
37+
- name: Install dependencies
38+
run: pip install -r requirements.txt
39+
40+
- name: Determine deployment context
41+
id: context
42+
run: |
43+
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
44+
echo "target_url=${{ inputs.target_url }}" >> $GITHUB_OUTPUT
45+
echo "environment=${{ inputs.environment }}" >> $GITHUB_OUTPUT
46+
else
47+
echo "target_url=${{ github.event.deployment.payload.web_url || '' }}" >> $GITHUB_OUTPUT
48+
echo "environment=${{ github.event.deployment.environment }}" >> $GITHUB_OUTPUT
49+
fi
50+
# Get diff since last successful scan
51+
PREV_SHA=$(git log --format='%H' -2 | tail -1)
52+
echo "prev_sha=$PREV_SHA" >> $GITHUB_OUTPUT
53+
CHANGED=$(git diff --name-only $PREV_SHA HEAD | head -100)
54+
echo "has_changes=$( [ -n "$CHANGED" ] && echo true || echo false )" >> $GITHUB_OUTPUT
55+
56+
- name: Run diff-scoped SAST scan
57+
if: steps.context.outputs.has_changes == 'true'
58+
env:
59+
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
60+
ONLY_CHANGED: "true"
61+
run: |
62+
python scripts/run_ai_audit.py \
63+
--project-type auto \
64+
--only-changed \
65+
--review-type security
66+
67+
- name: Run DAST against deployment
68+
if: steps.context.outputs.target_url != ''
69+
env:
70+
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
71+
DAST_TARGET_URL: ${{ steps.context.outputs.target_url }}
72+
run: |
73+
echo "Running DAST scan against $DAST_TARGET_URL"
74+
python -c "
75+
import sys
76+
sys.path.insert(0, 'scripts')
77+
try:
78+
from dast_orchestrator import DASTOrchestrator, OrchestratorConfig
79+
config = OrchestratorConfig(
80+
project_path='.',
81+
enable_nuclei=True,
82+
enable_zap=False,
83+
max_duration=600,
84+
)
85+
orch = DASTOrchestrator(config=config)
86+
results = orch.run('${{ steps.context.outputs.target_url }}')
87+
print(f'DAST scan complete: {len(results.get(\"findings\", []))} findings')
88+
except ImportError as e:
89+
print(f'DAST not available: {e}')
90+
except Exception as e:
91+
print(f'DAST scan error: {e}')
92+
"
93+
94+
- name: Upload results
95+
if: always()
96+
uses: actions/upload-artifact@v4
97+
with:
98+
name: post-deploy-scan-results
99+
path: |
100+
.argus/
101+
*.sarif
102+
retention-days: 30

CHANGELOG.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,29 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
99

1010
---
1111

12+
## [6.0.0] - 2026-03-04
13+
14+
### Added — Continuous Security Testing (v3.0)
15+
- **Diff-Intelligent Scanner Scoping** (`scripts/diff_impact_analyzer.py`): Classifies changed files by security relevance, expands blast radius via reverse dependency lookup, generates Semgrep `--include` args for scoped scanning. Toggle: `enable_diff_scoping=True`, `diff_expand_impact_radius=True`
16+
- **Agent-Driven Chain Discovery** (`scripts/agent_chain_discovery.py`): LLM-powered multi-step attack chain discovery beyond rule-based patterns. Cross-component analyzer detects dangerous finding combinations across architectural boundaries (auth+api, models+api, middleware+routes). Toggle: `enable_agent_chain_discovery=False` (opt-in), `enable_cross_component_analysis=True`
17+
- **AutoFix PR Generator** (`scripts/autofix_pr_generator.py`): Generates git branches with applied fixes from RemediationEngine suggestions. Creates conventional-commit-style messages, formatted PR bodies with diff/CWE/testing sections. ClosedLoopOrchestrator wires find-fix-verify into a single flow. Toggle: `enable_autofix_pr=False` (opt-in), `autofix_confidence_threshold="high"`, `autofix_max_prs_per_scan=5`
18+
- **Persistent Findings Store** (`scripts/findings_store.py`): SQLite-backed cross-scan intelligence. Tracks findings across scans via content-based fingerprinting. Detects regressions (previously-fixed findings reappearing), computes MTTF, FP rates, severity trending. Injects historical context into LLM enrichment prompts. Toggle: `enable_findings_store=True`, `findings_db_path=".argus/findings.db"`, `inject_historical_context=True`
19+
- **Application Context Builder** (`scripts/app_context_builder.py`): Detects framework (Django/Flask/Express/Spring/etc.), language, auth mechanism (JWT/OAuth2/session), cloud provider, IaC files, middleware chain, entry points, and OpenAPI specs. Generates `to_prompt_context()` string for LLM prompt injection. Toggle: `enable_app_context=True`
20+
- **SAST-to-DAST Live Validation** (`scripts/sast_dast_validator.py`): Validates SAST findings against live deployment targets. Maps vuln types to HTTP test payloads (SQLi, XSS, SSRF, path traversal, command injection, IDOR). Safety: rejects production targets by default, only allows staging/preview/development. Toggle: `enable_live_validation=False` (opt-in), `live_validation_environment="staging"`
21+
- **Post-Deploy Scan workflow** (`.github/workflows/post-deploy-scan.yml`): Triggers on successful deployments, runs diff-scoped SAST + DAST against deployment URL
22+
- **Retest After Fix workflow** (`.github/workflows/argus-retest.yml`): Triggers when `argus/fix-*` PRs merge, runs regression tests + targeted SAST rescan, updates FindingsStore
23+
- **Continuous Security Testing Guide** (`docs/CONTINUOUS_SECURITY_TESTING_GUIDE.md`): Architecture guide mapping capabilities vs industry-standard autonomous testing
24+
- 13 new config keys added to `config_loader.py` with env var and CLI mappings
25+
- All 7 modules integrated into `hybrid_analyzer.py` with graceful degradation
26+
- 36 new tests (`tests/test_continuous_security.py`) covering all v3.0 modules
27+
28+
### Changed
29+
- Updated README.md with v3.0 feature tables, env vars, and deployment scanning docs
30+
- Updated CLAUDE.md with v3.0 key files and extended documentation references
31+
- Updated `.claude/rules/features.md` and `.claude/rules/development.md` with v3.0 modules
32+
33+
---
34+
1235
## [5.0.0] - 2026-02-16
1336

1437
### Added

CLAUDE.md

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# CLAUDE.md - Argus Security
22

3-
> Enterprise-grade AI Security Platform with 6-phase analysis pipeline.
3+
> Enterprise-grade AI Security Platform with 6-phase analysis pipeline and continuous autonomous security testing.
44
55
## What This Does
66

@@ -17,6 +17,15 @@ Phase 6: Reporting → SARIF, JSON, Markdown outputs
1717

1818
**Results:** 60-70% false positive reduction, +15-20% more findings via heuristic-based spontaneous discovery (regex pattern matching, not AI-powered).
1919

20+
**v3.0 Continuous Security:**
21+
- Diff-intelligent scanner scoping with blast radius expansion
22+
- Persistent cross-scan findings store with regression detection
23+
- Application context auto-detection for context-aware scanning
24+
- LLM-powered attack chain discovery + cross-component analysis
25+
- AutoFix PR generation with closed-loop find-fix-verify
26+
- SAST-to-DAST live validation against staging targets
27+
- Deployment-triggered scanning via GitHub Actions workflows
28+
2029
## Quick Start
2130

2231
```bash
@@ -47,10 +56,17 @@ python scripts/run_ai_audit.py --project-type backend-api
4756
| `scripts/agent_personas.py` | Phase 3: multi-agent review |
4857
| `scripts/sandbox_validator.py` | Phase 4: Docker validation |
4958
| `policy/rego/` | Phase 5: OPA policies |
59+
| `scripts/diff_impact_analyzer.py` | v3.0: Diff-intelligent scanner scoping |
60+
| `scripts/findings_store.py` | v3.0: SQLite persistent findings store |
61+
| `scripts/app_context_builder.py` | v3.0: Application context auto-detection |
62+
| `scripts/agent_chain_discovery.py` | v3.0: LLM attack chain discovery |
63+
| `scripts/autofix_pr_generator.py` | v3.0: AutoFix PR generation + closed loop |
64+
| `scripts/sast_dast_validator.py` | v3.0: SAST-to-DAST live validation |
5065

5166
## Extended Documentation
5267

5368
Details moved to scoped rule files (auto-loaded when editing relevant files):
5469
- `.claude/rules/pipeline.md` — 6-phase pipeline architecture
55-
- `.claude/rules/features.md` — Advanced feature modules + config toggles
70+
- `.claude/rules/features.md` — Advanced feature modules + config toggles (incl. v3.0)
5671
- `.claude/rules/development.md` — Docker, GitHub Action, project structure
72+
- `docs/CONTINUOUS_SECURITY_TESTING_GUIDE.md` — v3.0 architecture and gap analysis

0 commit comments

Comments
 (0)