47 Commits

Include renames

Author	SHA1	Message	Date
sharang	0ec5fd8295	fix(dashboard): Findings/SBOM filter by targets + accurate target findings_count (#155)	2026-07-13 07:59:45 +00:00
sharang	bf32b9939a	fix(onboarding): targets visibility + unified pipeline by default (#154)	2026-07-13 07:29:04 +00:00
sharang	669e1f1b03	feat(onboarding): scan-trigger endpoint + wizard Run-Scan button (#153)	2026-07-12 22:19:32 +00:00
sharang	0e57c2d7a7	feat(pipeline): run tramiton classification + provision DAST in run_target (#146)	2026-07-12 21:49:22 +00:00
sharang	c6a02f0ac3	feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE (#145)	2026-07-12 21:31:21 +00:00
sharang	a204f0c59c	feat(api): onboarding endpoints for unified targets (#142)	2026-07-12 20:15:22 +00:00
sharang	cf4afdda1b	feat(migrate): onboarding backfill (repositories + dast_targets -> onboarded_targets) (#141)	2026-07-12 20:11:16 +00:00
sharang	ef6ee3dcd1	feat(onboarding): artifact ingest + classifier + native tramiton + suite seams (#138)	2026-07-10 16:00:51 +00:00
sharang	675c4ef699	feat(onboarding): unified multi-target model + scan matrix foundation (#134)	2026-07-10 13:41:25 +00:00
sharang	b851f4267a	feat(m7.3): scheduler pulls tenants from registry, env as fallback (#96) ... Replaces M7.2-C static SCHEDULER_TENANT_IDS with a live query to the tenant-registry at every tick. New tenants picked up without an agent restart; env stays as fallback so a registry outage never silences the scheduler. Resolution order: registry -> SCHEDULER_TENANT_IDS env -> DEFAULT_SCHEDULER_TENANT_ID. Logs the active source on startup.	2026-06-30 16:32:35 +00:00
sharang	a3a96fe2cc	feat(m7.3): MCP tenant-scoped bearer tokens (#92) ... MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.	2026-06-30 15:27:21 +00:00
sharang	ac24ca766a	feat(m7.3): cross-tenant admin HTTP endpoints (#95) ... GET /api/admin/tenants lists tenant DBs; DELETE /api/admin/tenants/{tenant_id} drops them (GDPR). Behind a separate auth path that rejects customer realm tokens.	2026-06-30 15:23:39 +00:00
sharang	485c3ff45e	chore(agent): remove stale unscoped webhook routes from API router (#93) ... Webhook routes live on the separate webhook server (port 3002). M7.2-C URL form is /webhook/{tenant_id}/{platform}/{repo_id}; mounting unscoped variants on the API router would mismatch handler signatures.	2026-06-30 15:18:31 +00:00
sharang	56482911b8	fix(dashboard): attach Keycloak token on agent API calls (#90)	2026-06-17 18:35:59 +00:00
sharang	183234f9af	feat(m7.1): wire compliance-agent to compliance-core auth + status gate (#85)	2026-06-17 09:36:52 +00:00
sharang	927fbc8ecb	fix: live progress + concurrency for embedding builds (#80)	2026-05-13 10:01:05 +00:00
sharang	e67a13535a	fix: add HTTP timeout to reqwest client and CVE stage timeout (#79)	2026-05-13 07:30:26 +00:00
sharangandSharang Parnerkar	df0063abc0	fix: scanner timeouts, semgrep memory cap, syft remote lookups, Script error (#78) ... ## Summary - **Scan produces no results in Orca** — semgrep (`--config=auto`, unbounded memory) and syft (remote license network calls) were getting OOM-killed or hanging in resource-constrained Orca containers. Scan would "complete" with 0 findings/SBOMs silently because each scanner failure is caught and logged as a warning. - **Dashboard Script error spam** — `document::Script` in Dioxus 0.7 needs a single text node child for inline scripts; `dangerous_inner_html` was invalid and spammed the error log on every unauthenticated page load. ## Changes | File | Change | |------|--------| | `semgrep.rs` | Add `--max-memory 500 --jobs 1`; 10-minute timeout | | `syft.rs` | Remove remote license lookup env vars; 5-minute timeout | | `gitleaks.rs` | 5-minute timeout | | `app_shell.rs` | Fix `dangerous_inner_html` → text child in `document::Script` | ## Test plan - [ ] Trigger a scan on a repo in Orca — findings and SBOM entries should now appear - [ ] Agent logs should show timeout/error warnings rather than silent empty results when tools are killed - [ ] Navigate to dashboard unauthenticated — Script error gone from logs - [ ] Verify scans work end-to-end with `docker compose up` --------- Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #78	2026-05-12 11:27:24 +00:00
Sharang ParnerkarandClaude Opus 4.6	c062d834a1	fix: downgrade dotenv missing file from FAILED to info message ... Non-fatal in Docker where env vars come from container config. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-30 15:33:24 +02:00
sharang	23cf37b6c3	fix: CVE notifications during scan + help chat doc loading + Dockerfile (#55)	2026-03-30 13:10:56 +00:00
sharang	49d5cd4e0a	feat: hourly CVE alerting with notification bell and API (#53)	2026-03-30 10:39:39 +00:00
sharang	4388e98b5b	feat: add E2E test suite with nightly CI, fix dashboard Dockerfile (#52)	2026-03-30 10:04:07 +00:00
sharang	a8bb05d7b1	feat: add floating help chat widget, remove settings page (#51)	2026-03-30 08:05:29 +00:00
sharang	bae24f9cf8	fix: cascade-delete DAST targets, pentests, and downstream data on repo delete (#50)	2026-03-30 07:11:23 +00:00
sharang	dd53132746	feat: refine all LLM system prompts for precision and reduced false positives (#49)	2026-03-30 07:11:17 +00:00
sharang	ff088f9eb4	feat: deduplicate code review findings across LLM passes (#48)	2026-03-29 20:38:52 +00:00
3 people	745ad8a441	fix: check Gitea API response status and fallback for PR reviews (#47) ... ## Summary - Add HTTP response status checking to all Gitea tracker methods that were silently swallowing errors - Add fallback in create_pr_review: if inline comments fail, retry as plain PR comment ## Test plan - [ ] Deploy and trigger a PR review, check logs for actual error details - [ ] Verify fallback posts summary comment when inline comments fail Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #47	2026-03-25 16:26:09 +00:00
sharang	a9d039dad3	fix: stop storing code review findings in dashboard (#22)	2026-03-18 15:18:07 +00:00
Sharang ParnerkarandClaude Opus 4.6	a509bdcb2e	fix: require TLS for IMAP auth, close port 143 (CERT-Bund compliance) ... - Remove port 143 from mailserver (only expose 993/IMAPS) - Enable SSL_TYPE=manual with Let's Encrypt certs - Set DOVECOT_DISABLE_PLAINTEXT_AUTH=yes - Add pentest_imap_tls config field (defaults to true) Fixes CERT-Bund report: IMAP PLAIN/LOGIN without TLS on 46.225.100.82:143 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-18 09:29:34 +01:00
sharangandSharang Parnerkar	c461faa2fb	feat: pentest onboarding — streaming, browser automation, reports, user cleanup (#16) ... Complete pentest feature overhaul: SSE streaming, session-persistent browser tool (CDP), AES-256 credential encryption, auto-screenshots in reports, code-level remediation correlation, SAST triage chunking, context window optimization, test user cleanup (Keycloak/Auth0/Okta), wizard dropdowns, attack chain improvements, architecture docs with Mermaid diagrams. Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #16	2026-03-17 20:32:20 +00:00
sharang	4eac1209d8	fix: remote Chrome PDF export & MCP endpoint sync (#15)	2026-03-13 10:12:20 +00:00
sharang	3bb690e5bb	refactor: modularize codebase and add 404 unit tests (#13)	2026-03-13 08:03:45 +00:00
sharang	acc5b86aa4	feat: AI-driven automated penetration testing (#12)	2026-03-12 14:42:54 +00:00
sharang	3ec1456b0d	docs: rewrite user-facing documentation with screenshots (#11)	2026-03-11 15:26:00 +00:00
sharang	491665559f	feat: per-repo issue tracker, Gitea support, PR review pipeline (#10)	2026-03-11 12:13:59 +00:00
Sharang ParnerkarandClaude Opus 4.6	99983c51e3	feat: enhance tracing with field attributes and warn logging across all handlers ... Add repo_id, finding_id, and filter fields to tracing::instrument attributes for better trace correlation in SigNoz. Replace all silently swallowed errors (Err(_) => Vec::new()) with tracing::warn! logging across mod.rs, dast.rs, graph.rs handlers. Add stage-level spans with .instrument() to pipeline orchestrator for visibility into scan phases. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-10 21:56:16 +01:00
Sharang ParnerkarandClaude Opus 4.6	67d6a937ae	feat: add OpenTelemetry trace spans to all handlers and pipeline functions ... Add #[tracing::instrument(skip_all)] to 44 functions: - 19 API handlers in mod.rs - 3 chat handlers, 6 DAST handlers, 7 graph handlers - 2 pipeline orchestrator functions - 7 scanner functions (sbom, semgrep, gitleaks, cve, lint, patterns) This generates trace spans for SigNoz visibility into request latency, scan pipeline stages, and error tracking. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-10 17:08:13 +01:00
sharang	daff5812a6	fix: SBOM multi-ecosystem support with correct package managers and licenses (#8)	2026-03-10 12:37:29 +00:00
sharang	46bf9de549	feat: findings refinement, new scanners, and deployment tooling (#6)	2026-03-09 12:53:12 +00:00
sharangandSharang Parnerkar	65abc55915	feat: opentelemetry-tracing (#3) ... Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #3	2026-03-07 23:51:20 +00:00
sharangandSharang Parnerkar	0cb06d3d6d	feat: add Keycloak authentication for dashboard and API endpoints (#2) ... Dashboard: OAuth2/OIDC login flow with PKCE, session-based auth middleware protecting all server function endpoints, check-auth server function for frontend auth state, login page gate in AppShell, user info in sidebar. Agent API: JWT validation middleware using Keycloak JWKS endpoint, conditionally enabled when KEYCLOAK_URL and KEYCLOAK_REALM are set. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #2	2026-03-07 23:50:56 +00:00
sharangandSharang Parnerkar	42cabf0582	feat: rag-embedding-ai-chat (#1) ... Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #1	2026-03-06 21:54:15 +00:00
Sharang ParnerkarandClaude Opus 4.6	b18824db25	Add graph explorer components, API handlers, and dependency updates ... Adds code inspector, file tree components, graph visualization JS, graph API handlers, sidebar navigation updates, and misc improvements. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-04 21:52:49 +01:00
Sharang ParnerkarandClaude Opus 4.6	cea8f59e10	Add DAST, graph modules, toast notifications, and dashboard enhancements ... Add DAST scanning and code knowledge graph features across the stack: - compliance-dast and compliance-graph workspace crates - Agent API handlers and routes for DAST targets/scans and graph builds - Core models and traits for DAST and graph domains - Dashboard pages for DAST targets/findings/overview and graph explorer/impact - Toast notification system with auto-dismiss for async action feedback - Button click animations and disabled states for better UX Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-04 13:53:50 +01:00
Sharang ParnerkarandClaude Opus 4.6	03ee69834d	Fix formatting and clippy warnings across workspace ... - Run cargo fmt on all crates - Fix regex patterns using unsupported lookahead in patterns.rs - Replace unwrap() calls with compile_regex() helper - Fix never type fallback in GitHub tracker - Fix redundant field name in findings page - Allow enum_variant_names for Dioxus Route enum - Fix &mut Vec -> &mut [T] clippy lint in sbom.rs - Mark unused-but-intended APIs with #[allow(dead_code)] Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-02 17:41:03 +01:00
Sharang ParnerkarandClaude Opus 4.6	37689d4661	Fix dashboard wasm build and feature-gate mongodb for wasm compatibility ... - Feature-gate mongodb in compliance-core (optional, default on) so wasm builds don't pull in tokio/mio via mongodb - Use bson v2 directly for ObjectId types (wasm-compatible) - Restructure dashboard infrastructure/mod.rs: server function modules always compiled (for RPC stubs), server-only modules cfg-gated - Remove reqwest from dashboard web feature (not needed, data flows through server functions) - Add .gitignore Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-02 17:16:38 +01:00
Sharang ParnerkarandClaude Opus 4.6	0867e401bc	Initial commit: Compliance Scanner Agent ... Autonomous security and compliance scanning agent for git repositories. Features: SAST (Semgrep), SBOM (Syft), CVE monitoring (OSV.dev/NVD), GDPR/OAuth pattern detection, LLM triage, issue creation (GitHub/GitLab/Jira), PR reviews, and Dioxus fullstack dashboard. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-02 13:30:17 +01:00