ShieldFlow

Overview

ShieldFlow is an automated DevSecOps and Security Orchestration, Automation, and Response (SOAR) platform designed to detect, enrich, route, and enforce remediation of security findings throughout the software development lifecycle.

The platform integrates Static Application Security Testing (SAST), Secret Scanning, Software Composition Analysis (SCA), Dynamic Application Security Testing (DAST), automated case management, email-based alerting, dashboard reporting, and deployment gating into a single workflow.

Key Features

Security Scanning

• Semgrep (SAST)
• Gitleaks (Secrets Detection)
• Trivy (Software Composition Analysis)
• OWASP ZAP (Dynamic Application Security Testing)

Automated Response

• Automated finding ingestion
• Finding normalization and enrichment
• Deduplication engine
• Case management system
• Email alerting
• Security dashboard

Security Controls

• Deployment gate for critical vulnerabilities
• Webhook authentication
• Threat modeling
• Artifact validation
• Automated vulnerability triage

Reporting

• Real-time dashboard
• Vulnerability reports
• Architecture documentation
• Security metrics and MTTT calculations

---

Architecture

Developer Push
        │
        ▼
GitHub Actions Pipeline
        │
        ▼
┌─────────────────────────────────────┐
│ Security Scanning Layer             │
│ • Semgrep (SAST)                    │
│ • Gitleaks (Secrets Detection)      │
│ • Trivy (SCA)                       │
│ • OWASP ZAP (DAST)                  │
└─────────────────────────────────────┘
        │
        ▼
JSON / SARIF Reports
        │
        ▼
Master Parser
        │
        ▼
SOAR Engine
        │
        ▼
Case Management
        │
        ▼
Email Alerts
        │
        ▼
Dashboard & Metrics
        │
        ▼
Deployment Decision

---

---

Technology Stack

Component	Technology
Source Control	GitHub
CI/CD	GitHub Actions
SAST	Semgrep
Secrets Detection	Gitleaks
SCA	Trivy
DAST	OWASP ZAP
SOAR	Custom Python Automation
Dashboard	HTML, CSS, JavaScript
Database	PostgreSQL
Containerization	Docker
Email Notifications	SMTP

---

Project Structure

ShieldFlow/
│
├── .github/
│   └── workflows/
│       └── pipeline.yml
│
├── target-app/
│   ├── app.py
│   └── requirements.txt
│
├── soar/
│   ├── parsers/
│   │   ├── semgrep_parser.py
│   │   ├── trivy_parser.py
│   │   ├── zap_parser.py
│   │   └── master_parser.py
│   │
│   ├── playbooks/
│   │   ├── playbook1_secret.py
│   │   ├── playbook2_critical_cve.py
│   │   ├── playbook3_owasp_flaw.py
│   │   └── utils.py
│   │
│   ├── cases/
│   │   └── cases.json
│   │
│   └── webhook_server.py
│
├── dashboard/
│   └── dashboard.html
│
├── docs/
│   ├── architecture-document.md
│   ├── threat-model.md
│   └── retrospective.md
│
├── findings/
│   └── vulnerability-report.md
│
├── reports/
│
└── docker-compose.yml

---

Environment Setup

Clone Repository

git clone https://github.com/Adnanmardini/ShieldFlow

cd ShieldFlow

Docker Environment

Start all containers:

docker-compose up -d

Verify:

docker ps

Expected Services:

• Juice Shop
• Shuffle Backend
• Shuffle Frontend
• PostgreSQL

---

Accessing Services

Service	URL
Juice Shop	http://localhost:3000
Shuffle SOAR	http://localhost:3001
Dashboard	dashboard/dashboard.html

---

Running Security Scans

Semgrep

semgrep scan --config=auto --json > semgrep.json

Gitleaks

gitleaks detect --report-format json --report-path gitleaks.json

Trivy

trivy fs . --format json --output trivy.json

OWASP ZAP

docker run zaproxy/zap-stable zap-baseline.py
-t http://host.docker.internal:3000
-J zap.json

---

Running SOAR Playbooks

Secret Exposure

python3 soar/playbooks/playbook1_secret.py

Critical CVE

python3 soar/playbooks/playbook2_critical_cve.py

OWASP Findings

python3 soar/playbooks/playbook3_owasp_flaw.py

---

Security Gate

ShieldFlow prevents vulnerable code from reaching production.

Deployment is automatically blocked when:

• Critical CVEs are detected
• Security gate validation fails

Pipeline Result:

❌ DEPLOYMENT DENIED

---

Threat Model

The project includes mitigation for:

Scanner Bypass

Mitigation:

• Mandatory scanner execution
• Pipeline validation checks

Webhook Spoofing

Mitigation:

• Authorization token validation

Artifact Tampering

Mitigation:

• Only pipeline-generated reports accepted

Unauthorized Deployments

Mitigation:

• Automated security gate enforcement

---

Metrics

ShieldFlow tracks:

• Total Findings
• Findings by Severity
• Open vs Closed Cases
• Mean Time To Triage (MTTT)
• Critical Vulnerability Counts

---

Deliverables

• Automated DevSecOps Pipeline
• SOAR Automation Platform
• Security Dashboard
• Deployment Security Gate
• Threat Model
• Vulnerability Reports
• Architecture Documentation
• Retrospective Report

---

Team

Project Information

Item	Details
Project Name	ShieldFlow
Team Name	DefenseGrid

Team Members

Name
Adnan Mardini
Peter Abiya
Oluwanifemi Aduraponmile
Oneneobari Obe
Chancelle Ahinon

Team Responsibilities

• Infrastructure & CI/CD
• SAST & Secrets Detection
• SCA & DAST
• SOAR Automation & Dashboard

---

Disclaimer

This project was developed in a controlled educational environment for DevSecOps and Application Security learning purposes. Vulnerabilities included in the target application are intentionally introduced for testing and demonstration.