58 Commits

Include renames

Author	SHA1	Message	Date
sharang	a3f3f1d4f5	feat(plc): ingest CODESYS projects from a git repo (SAST + SBOM) (#171)	2026-07-16 15:47:04 +00:00
sharang	7369e031c4	feat(plc): control-application SBOM from CODESYS .projectarchive (#170)	2026-07-16 15:28:42 +00:00
sharang	386d8457d6	feat(plc): analyse graphical logic (FBD/LD) from PLCopen XML (#169)	2026-07-16 11:43:49 +00:00
sharang	3a53a1d7f2	feat(matrix): PlcSps composite device target (SBOM/CVE/DAST/pentest) (#168)	2026-07-16 10:56:36 +00:00
sharang	afa5c985ee	feat(onboarding): PLC/blob file upload (multipart) + single-file ingest fix (#163)	2026-07-16 09:41:12 +00:00
sharang	6d02b138c6	feat(pipeline): PLC/SPS control-logic security scanner (IEC 61131-3) (#162)	2026-07-16 08:31:43 +00:00
sharang	a981311413	refactor: rip out the legacy TrackedRepository / repositories path (#161)	2026-07-16 07:25:45 +00:00
sharang	87f240b26f	feat(onboarding): input validation + editable targets (#160)	2026-07-13 17:57:48 +00:00
sharang	71aceafa26	fix(deps): bump tramiton to v0.4.1 (proot-safe firmware build) (#158)	2026-07-13 11:21:43 +00:00
sharang	b12d18d99d	feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2) (#157)	2026-07-13 10:15:06 +00:00
sharang	eaaafc0621	feat(pipeline): analysis-based firmware SBOM from tramiton (#156)	2026-07-13 08:31:33 +00:00
sharang	0ec5fd8295	fix(dashboard): Findings/SBOM filter by targets + accurate target findings_count (#155)	2026-07-13 07:59:45 +00:00
sharang	bf32b9939a	fix(onboarding): targets visibility + unified pipeline by default (#154)	2026-07-13 07:29:04 +00:00
sharang	669e1f1b03	feat(onboarding): scan-trigger endpoint + wizard Run-Scan button (#153)	2026-07-12 22:19:32 +00:00
sharang	0e57c2d7a7	feat(pipeline): run tramiton classification + provision DAST in run_target (#146)	2026-07-12 21:49:22 +00:00
sharang	c6a02f0ac3	feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE (#145)	2026-07-12 21:31:21 +00:00
sharang	a204f0c59c	feat(api): onboarding endpoints for unified targets (#142)	2026-07-12 20:15:22 +00:00
sharang	cf4afdda1b	feat(migrate): onboarding backfill (repositories + dast_targets -> onboarded_targets) (#141)	2026-07-12 20:11:16 +00:00
sharang	ef6ee3dcd1	feat(onboarding): artifact ingest + classifier + native tramiton + suite seams (#138)	2026-07-10 16:00:51 +00:00
sharang	675c4ef699	feat(onboarding): unified multi-target model + scan matrix foundation (#134)	2026-07-10 13:41:25 +00:00
sharang	b851f4267a	feat(m7.3): scheduler pulls tenants from registry, env as fallback (#96) ... Replaces M7.2-C static SCHEDULER_TENANT_IDS with a live query to the tenant-registry at every tick. New tenants picked up without an agent restart; env stays as fallback so a registry outage never silences the scheduler. Resolution order: registry -> SCHEDULER_TENANT_IDS env -> DEFAULT_SCHEDULER_TENANT_ID. Logs the active source on startup.	2026-06-30 16:32:35 +00:00
sharang	a3a96fe2cc	feat(m7.3): MCP tenant-scoped bearer tokens (#92) ... MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.	2026-06-30 15:27:21 +00:00
sharang	ac24ca766a	feat(m7.3): cross-tenant admin HTTP endpoints (#95) ... GET /api/admin/tenants lists tenant DBs; DELETE /api/admin/tenants/{tenant_id} drops them (GDPR). Behind a separate auth path that rejects customer realm tokens.	2026-06-30 15:23:39 +00:00
sharang	485c3ff45e	chore(agent): remove stale unscoped webhook routes from API router (#93) ... Webhook routes live on the separate webhook server (port 3002). M7.2-C URL form is /webhook/{tenant_id}/{platform}/{repo_id}; mounting unscoped variants on the API router would mismatch handler signatures.	2026-06-30 15:18:31 +00:00
sharang	56482911b8	fix(dashboard): attach Keycloak token on agent API calls (#90)	2026-06-17 18:35:59 +00:00
sharang	183234f9af	feat(m7.1): wire compliance-agent to compliance-core auth + status gate (#85)	2026-06-17 09:36:52 +00:00
sharang	927fbc8ecb	fix: live progress + concurrency for embedding builds (#80)	2026-05-13 10:01:05 +00:00
sharang	e67a13535a	fix: add HTTP timeout to reqwest client and CVE stage timeout (#79)	2026-05-13 07:30:26 +00:00
sharangandSharang Parnerkar	df0063abc0	fix: scanner timeouts, semgrep memory cap, syft remote lookups, Script error (#78) ... ## Summary - **Scan produces no results in Orca** — semgrep (`--config=auto`, unbounded memory) and syft (remote license network calls) were getting OOM-killed or hanging in resource-constrained Orca containers. Scan would "complete" with 0 findings/SBOMs silently because each scanner failure is caught and logged as a warning. - **Dashboard Script error spam** — `document::Script` in Dioxus 0.7 needs a single text node child for inline scripts; `dangerous_inner_html` was invalid and spammed the error log on every unauthenticated page load. ## Changes | File | Change | |------|--------| | `semgrep.rs` | Add `--max-memory 500 --jobs 1`; 10-minute timeout | | `syft.rs` | Remove remote license lookup env vars; 5-minute timeout | | `gitleaks.rs` | 5-minute timeout | | `app_shell.rs` | Fix `dangerous_inner_html` → text child in `document::Script` | ## Test plan - [ ] Trigger a scan on a repo in Orca — findings and SBOM entries should now appear - [ ] Agent logs should show timeout/error warnings rather than silent empty results when tools are killed - [ ] Navigate to dashboard unauthenticated — Script error gone from logs - [ ] Verify scans work end-to-end with `docker compose up` --------- Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #78	2026-05-12 11:27:24 +00:00
Sharang ParnerkarandClaude Opus 4.6	c062d834a1	fix: downgrade dotenv missing file from FAILED to info message ... Non-fatal in Docker where env vars come from container config. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-30 15:33:24 +02:00
sharang	23cf37b6c3	fix: CVE notifications during scan + help chat doc loading + Dockerfile (#55)	2026-03-30 13:10:56 +00:00
sharang	49d5cd4e0a	feat: hourly CVE alerting with notification bell and API (#53)	2026-03-30 10:39:39 +00:00
sharang	4388e98b5b	feat: add E2E test suite with nightly CI, fix dashboard Dockerfile (#52)	2026-03-30 10:04:07 +00:00
sharang	a8bb05d7b1	feat: add floating help chat widget, remove settings page (#51)	2026-03-30 08:05:29 +00:00
sharang	bae24f9cf8	fix: cascade-delete DAST targets, pentests, and downstream data on repo delete (#50)	2026-03-30 07:11:23 +00:00
sharang	dd53132746	feat: refine all LLM system prompts for precision and reduced false positives (#49)	2026-03-30 07:11:17 +00:00
sharang	ff088f9eb4	feat: deduplicate code review findings across LLM passes (#48)	2026-03-29 20:38:52 +00:00
3 people	745ad8a441	fix: check Gitea API response status and fallback for PR reviews (#47) ... ## Summary - Add HTTP response status checking to all Gitea tracker methods that were silently swallowing errors - Add fallback in create_pr_review: if inline comments fail, retry as plain PR comment ## Test plan - [ ] Deploy and trigger a PR review, check logs for actual error details - [ ] Verify fallback posts summary comment when inline comments fail Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #47	2026-03-25 16:26:09 +00:00
sharang	a9d039dad3	fix: stop storing code review findings in dashboard (#22)	2026-03-18 15:18:07 +00:00
Sharang ParnerkarandClaude Opus 4.6	a509bdcb2e	fix: require TLS for IMAP auth, close port 143 (CERT-Bund compliance) ... - Remove port 143 from mailserver (only expose 993/IMAPS) - Enable SSL_TYPE=manual with Let's Encrypt certs - Set DOVECOT_DISABLE_PLAINTEXT_AUTH=yes - Add pentest_imap_tls config field (defaults to true) Fixes CERT-Bund report: IMAP PLAIN/LOGIN without TLS on 46.225.100.82:143 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-18 09:29:34 +01:00
sharangandSharang Parnerkar	c461faa2fb	feat: pentest onboarding — streaming, browser automation, reports, user cleanup (#16) ... Complete pentest feature overhaul: SSE streaming, session-persistent browser tool (CDP), AES-256 credential encryption, auto-screenshots in reports, code-level remediation correlation, SAST triage chunking, context window optimization, test user cleanup (Keycloak/Auth0/Okta), wizard dropdowns, attack chain improvements, architecture docs with Mermaid diagrams. Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #16	2026-03-17 20:32:20 +00:00
sharang	4eac1209d8	fix: remote Chrome PDF export & MCP endpoint sync (#15)	2026-03-13 10:12:20 +00:00
sharang	3bb690e5bb	refactor: modularize codebase and add 404 unit tests (#13)	2026-03-13 08:03:45 +00:00
sharang	acc5b86aa4	feat: AI-driven automated penetration testing (#12)	2026-03-12 14:42:54 +00:00
sharang	3ec1456b0d	docs: rewrite user-facing documentation with screenshots (#11)	2026-03-11 15:26:00 +00:00
sharang	491665559f	feat: per-repo issue tracker, Gitea support, PR review pipeline (#10)	2026-03-11 12:13:59 +00:00
Sharang ParnerkarandClaude Opus 4.6	99983c51e3	feat: enhance tracing with field attributes and warn logging across all handlers ... Add repo_id, finding_id, and filter fields to tracing::instrument attributes for better trace correlation in SigNoz. Replace all silently swallowed errors (Err(_) => Vec::new()) with tracing::warn! logging across mod.rs, dast.rs, graph.rs handlers. Add stage-level spans with .instrument() to pipeline orchestrator for visibility into scan phases. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-10 21:56:16 +01:00
Sharang ParnerkarandClaude Opus 4.6	67d6a937ae	feat: add OpenTelemetry trace spans to all handlers and pipeline functions ... Add #[tracing::instrument(skip_all)] to 44 functions: - 19 API handlers in mod.rs - 3 chat handlers, 6 DAST handlers, 7 graph handlers - 2 pipeline orchestrator functions - 7 scanner functions (sbom, semgrep, gitleaks, cve, lint, patterns) This generates trace spans for SigNoz visibility into request latency, scan pipeline stages, and error tracking. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-10 17:08:13 +01:00
sharang	daff5812a6	fix: SBOM multi-ecosystem support with correct package managers and licenses (#8)	2026-03-10 12:37:29 +00:00
sharang	46bf9de549	feat: findings refinement, new scanners, and deployment tooling (#6)	2026-03-09 12:53:12 +00:00