43 Commits

Include renames

Author	SHA1	Message	Date
sharang	3e233da128	feat(controls): promote grounded controls to covered + enable LLM passes by default (#224)	2026-07-22 07:48:51 +00:00
sharang	4ef257bfe2	feat(controls): B2 — grounded surface checks for absence-based CRA controls (#219)	2026-07-21 12:48:12 +00:00
sharang	0ef2cd1b23	feat(agent): cache control embedding index + auto-wire semantic pass (gated) (#217)	2026-07-21 11:29:16 +00:00
sharang	18a23403a1	feat(oscal): emit unmapped findings as-is + MCP oscal_assessment tool (#214)	2026-07-21 09:48:37 +00:00
sharang	c6baf72c6d	feat: control-driven SAST — LUT + grounded LLM triage over tool findings (#213)	2026-07-21 09:01:51 +00:00
sharang	5285fb67ae	feat(oscal): live assessment endpoint POST /api/v1/oscal/assess (#212)	2026-07-20 19:13:47 +00:00
sharang	ca4e31cb65	feat(oscal): assessment-results emitter + finding->control linker (#211)	2026-07-20 16:53:39 +00:00
sharang	d4884cfe4f	feat(oscal): ingest breakpilot OSCAL catalog via OscalControlsProvider (#210)	2026-07-20 16:19:09 +00:00
sharang	91a87677bc	feat(werkbank): runner queue endpoints + result persistence (WB-05) (#207)	2026-07-17 11:42:29 +00:00
sharang	633f945a1e	feat(werkbank): Mongo-backed job queue with lease + visibility timeout (WB-02) (#206)	2026-07-17 09:15:23 +00:00
sharang	7b218fffef	feat(werkbank): job/result contract in compliance-core (WB-01) (#205)	2026-07-17 08:54:11 +00:00
sharang	7ad7bce9db	feat(plc): dynamic PLC testing via ephemeral soft-PLC (#193)	2026-07-17 07:47:43 +00:00
sharang	0f4c75b6b3	fix(matrix): DAST needs an http(s) endpoint; don't offer/run it on modbus:// (#182)	2026-07-16 21:28:47 +00:00
sharang	b7406eca15	feat(onboarding): Project-archive PLC format + auto-detect (#179)	2026-07-16 20:05:05 +00:00
sharang	77eced8314	feat(ics): dynamic Modbus/TCP probe for PLC/SPS devices (#172)	2026-07-16 16:25:04 +00:00
sharang	a3f3f1d4f5	feat(plc): ingest CODESYS projects from a git repo (SAST + SBOM) (#171)	2026-07-16 15:47:04 +00:00
sharang	3a53a1d7f2	feat(matrix): PlcSps composite device target (SBOM/CVE/DAST/pentest) (#168)	2026-07-16 10:56:36 +00:00
sharang	a981311413	refactor: rip out the legacy TrackedRepository / repositories path (#161)	2026-07-16 07:25:45 +00:00
sharang	bf32b9939a	fix(onboarding): targets visibility + unified pipeline by default (#154)	2026-07-13 07:29:04 +00:00
sharang	c6a02f0ac3	feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE (#145)	2026-07-12 21:31:21 +00:00
sharang	ef6ee3dcd1	feat(onboarding): artifact ingest + classifier + native tramiton + suite seams (#138)	2026-07-10 16:00:51 +00:00
sharang	675c4ef699	feat(onboarding): unified multi-target model + scan matrix foundation (#134)	2026-07-10 13:41:25 +00:00
sharang	a3a96fe2cc	feat(m7.3): MCP tenant-scoped bearer tokens (#92) ... MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.	2026-06-30 15:27:21 +00:00
sharang	ac24ca766a	feat(m7.3): cross-tenant admin HTTP endpoints (#95) ... GET /api/admin/tenants lists tenant DBs; DELETE /api/admin/tenants/{tenant_id} drops them (GDPR). Behind a separate auth path that rejects customer realm tokens.	2026-06-30 15:23:39 +00:00
sharang	dbadff0aac	fix(m7.1): JWKS refresh-on-failure in auth middleware (#84)	2026-06-04 14:46:14 +00:00
sharang	116293519d	M7.1 smoke harness: lift auth to compliance-core + compliance-smoke service (#83)	2026-06-04 14:38:35 +00:00
sharang	49d5cd4e0a	feat: hourly CVE alerting with notification bell and API (#53)	2026-03-30 10:39:39 +00:00
Sharang ParnerkarandClaude Opus 4.6	a509bdcb2e	fix: require TLS for IMAP auth, close port 143 (CERT-Bund compliance) ... - Remove port 143 from mailserver (only expose 993/IMAPS) - Enable SSL_TYPE=manual with Let's Encrypt certs - Set DOVECOT_DISABLE_PLAINTEXT_AUTH=yes - Add pentest_imap_tls config field (defaults to true) Fixes CERT-Bund report: IMAP PLAIN/LOGIN without TLS on 46.225.100.82:143 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-18 09:29:34 +01:00
sharangandSharang Parnerkar	c461faa2fb	feat: pentest onboarding — streaming, browser automation, reports, user cleanup (#16) ... Complete pentest feature overhaul: SSE streaming, session-persistent browser tool (CDP), AES-256 credential encryption, auto-screenshots in reports, code-level remediation correlation, SAST triage chunking, context window optimization, test user cleanup (Keycloak/Auth0/Okta), wizard dropdowns, attack chain improvements, architecture docs with Mermaid diagrams. Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #16	2026-03-17 20:32:20 +00:00
sharang	3bb690e5bb	refactor: modularize codebase and add 404 unit tests (#13)	2026-03-13 08:03:45 +00:00
sharang	acc5b86aa4	feat: AI-driven automated penetration testing (#12)	2026-03-12 14:42:54 +00:00
sharang	491665559f	feat: per-repo issue tracker, Gitea support, PR review pipeline (#10)	2026-03-11 12:13:59 +00:00
sharang	46bf9de549	feat: findings refinement, new scanners, and deployment tooling (#6)	2026-03-09 12:53:12 +00:00
sharangandSharang Parnerkar	32e5fc21e7	feat: add MCP server for exposing compliance data to LLMs (#5) ... New `compliance-mcp` crate providing a Model Context Protocol server with 7 tools: list/get/summarize findings, list SBOM packages, SBOM vulnerability report, list DAST findings, and DAST scan summary. Supports stdio (local dev) and Streamable HTTP (deployment via MCP_PORT). Includes Dockerfile, CI clippy check, and Coolify deploy job. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #5	2026-03-09 08:21:04 +00:00
Sharang ParnerkarandClaude Opus 4.6	5a4af292fc	Fix OTLP HTTP exporter: use reqwest-rustls for HTTPS support ... The reqwest-client feature doesn't include TLS support, causing NoHttpClient error when connecting to HTTPS endpoints. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 17:07:41 +01:00
Sharang ParnerkarandClaude Opus 4.6	04c8084943	Switch OTLP exporter from gRPC/tonic to HTTP/reqwest ... gRPC requires special reverse proxy config for HTTP/2. HTTP works behind standard HTTPS proxies like Traefik/Caddy on port 4318. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 17:01:02 +01:00
sharangandSharang Parnerkar	65abc55915	feat: opentelemetry-tracing (#3) ... Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #3	2026-03-07 23:51:20 +00:00
sharangandSharang Parnerkar	0cb06d3d6d	feat: add Keycloak authentication for dashboard and API endpoints (#2) ... Dashboard: OAuth2/OIDC login flow with PKCE, session-based auth middleware protecting all server function endpoints, check-auth server function for frontend auth state, login page gate in AppShell, user info in sidebar. Agent API: JWT validation middleware using Keycloak JWKS endpoint, conditionally enabled when KEYCLOAK_URL and KEYCLOAK_REALM are set. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #2	2026-03-07 23:50:56 +00:00
sharangandSharang Parnerkar	42cabf0582	feat: rag-embedding-ai-chat (#1) ... Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #1	2026-03-06 21:54:15 +00:00
Sharang ParnerkarandClaude Opus 4.6	cea8f59e10	Add DAST, graph modules, toast notifications, and dashboard enhancements ... Add DAST scanning and code knowledge graph features across the stack: - compliance-dast and compliance-graph workspace crates - Agent API handlers and routes for DAST targets/scans and graph builds - Core models and traits for DAST and graph domains - Dashboard pages for DAST targets/findings/overview and graph explorer/impact - Toast notification system with auto-dismiss for async action feedback - Button click animations and disabled states for better UX Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-04 13:53:50 +01:00
Sharang ParnerkarandClaude Opus 4.6	03ee69834d	Fix formatting and clippy warnings across workspace ... - Run cargo fmt on all crates - Fix regex patterns using unsupported lookahead in patterns.rs - Replace unwrap() calls with compile_regex() helper - Fix never type fallback in GitHub tracker - Fix redundant field name in findings page - Allow enum_variant_names for Dioxus Route enum - Fix &mut Vec -> &mut [T] clippy lint in sbom.rs - Mark unused-but-intended APIs with #[allow(dead_code)] Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-02 17:41:03 +01:00
Sharang ParnerkarandClaude Opus 4.6	37689d4661	Fix dashboard wasm build and feature-gate mongodb for wasm compatibility ... - Feature-gate mongodb in compliance-core (optional, default on) so wasm builds don't pull in tokio/mio via mongodb - Use bson v2 directly for ObjectId types (wasm-compatible) - Restructure dashboard infrastructure/mod.rs: server function modules always compiled (for RPC stubs), server-only modules cfg-gated - Remove reqwest from dashboard web feature (not needed, data flows through server functions) - Add .gitignore Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-02 17:16:38 +01:00
Sharang ParnerkarandClaude Opus 4.6	0867e401bc	Initial commit: Compliance Scanner Agent ... Autonomous security and compliance scanning agent for git repositories. Features: SAST (Semgrep), SBOM (Syft), CVE monitoring (OSV.dev/NVD), GDPR/OAuth pattern detection, LLM triage, issue creation (GitHub/GitLab/Jira), PR reviews, and Dioxus fullstack dashboard. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-02 13:30:17 +01:00