Security Scanner

Security Scanner

The security scanner lives at security/security_scan.py and is run automatically by the pre-commit hook.

Usage

# Full scan
python security/security_scan.py --profile security/profiles/saturnzap.yaml

# Auto-fix safe issues (ruff only)
python security/security_scan.py --profile security/profiles/saturnzap.yaml --autofix safe

# Save baseline
python security/security_scan.py --profile security/profiles/saturnzap.yaml --baseline-save security/baselines/initial.json

# Compare against baseline
python security/security_scan.py --profile security/profiles/saturnzap.yaml --baseline-compare security/baselines/initial.json

Tools

Tool	Purpose	Severity
ruff	Code quality linting	LOW
bandit	Security-focused static analysis	MEDIUM / HIGH
pip-audit	Dependency vulnerability scanning	HIGH
detect-secrets	Hardcoded secret detection	CRITICAL

Grading

Grade	Criteria
A+	No findings
A	INFO findings only
B	LOW findings
C	MEDIUM findings (or >5 LOW)
D	HIGH findings (or >3 MEDIUM)
F	CRITICAL findings

Pre-commit Gate

The hook blocks commits if the scanner exits with code 1 (CRITICAL or HIGH findings detected). LOW and MEDIUM findings produce warnings but allow the commit.

Profile

The scan profile is at security/profiles/saturnzap.yaml. It specifies:

• ruff_target: src/saturnzap/
• bandit_target: src/saturnzap/
• accepted_risks: CVEs reviewed and accepted (initially empty)