{% set report_total_issues = namespace(val=0) %} {% set report_total_blocking = namespace(val=0) %} {% for r in results %} {% set report_total_issues.val = report_total_issues.val + r.total_issues %} {% set report_total_blocking.val = report_total_blocking.val + r.blocking_issues %} {% endfor %}

Evidence package / Local workspace

Security assessment

Release decision, scanner evidence, and remediation guidance packaged for review and sharing.

Download dossier Download share bundle

Release gate {% if final_status == 'BLOCKED' %}Blocked{% elif final_status == 'ALLOWED' %}Passed{% else %}Incomplete{% endif %}

Blocking issues {{ report_total_blocking.val }}

Must be resolved or accepted before release.

Total findings {{ report_total_issues.val }}

Across {{ results | length }} scanner modules.

Heuristic risk index {{ exploitability_score }}/100

Relative severity signal; not a probability.

{% if final_status == 'BLOCKED' %}Deployment blocked{% elif final_status == 'ALLOWED' %}Deployment passed{% else %}Scan incomplete{% endif %}

> CRITICAL_GATE_STATUS: {{ reason }}

🎓 EXECUTIVE SECURITY GLOSSARY

This report is compiled from automated security scanning tools checking the target codebase. If any severe vulnerabilities are found, the deployment gate blocks the release to ensure the live environment is not compromised.

The heuristic risk index is a relative severity signal derived from findings. It is not a calibrated probability of exploitation and does not override the release decision.

The scanner rows below show the tools and coverage available for this run. CodeQL paths and signature matches are leads for review, not proof of an exploit or malware.

Scanner results

{% set total_issues = namespace(val=0) %} {% for r in results %} {% set total_issues.val = total_issues.val + r.total_issues %} {% endfor %} {{ total_issues.val }}

Reported findings

{% set total_blocking = namespace(val=0) %} {% for r in results %} {% set total_blocking.val = total_blocking.val + r.blocking_issues %} {% endfor %} {{ total_blocking.val }}

Blocking Issues

{{ exploitability_score }}/100

Heuristic risk index

Upload Python script for audit

READY

Select a local Python (.py) script file to run a security audit scan on it.

Software bill of materials (SBOM)

CYCLONEDX_1.5

A Software Bill of Materials (SBOM) has been generated in CycloneDX v1.5 JSON format, mapping the full dependency inventory of third-party libraries used by this application.

DOWNLOAD_CYCLONEDX_SBOM

Scanner evidence

{% for result in results %}

{% if result.examples %} {% for example in result.examples %}

{% if example.severity %} {{ example.severity }} {% if result.tool == 'Bandit' or result.tool == 'Ruff (SAST)' %} {{ example.issue_text }} {% elif result.tool == 'Semgrep' %} {{ example.issue_text }} {% elif result.tool == 'CodeQL' %} {{ example.issue_text }} {% elif result.tool == 'Safety' %} Insecure Package: {{ example.package_name }} {% elif result.tool == 'OSV Dependency Audit' %} OSV Vulnerability: {{ example.id }} ({{ example.package_name }}) {% elif result.tool == 'Trivy' %} Vulnerability: {{ example.vulnerability_id }} ({{ example.package_name }}) {% elif result.tool == 'Secrets Scanner' %} Hardcoded Secret: {{ example.type }} {% elif result.tool == 'YARA Scanner' %} Malicious Pattern Matched: {{ example.rule }} {% elif result.tool == 'ClamAV' %} Malware Signature Matched: {{ example.virus }} {% elif result.tool == 'Aegis DAST Probe' %} Active DAST Alert: {{ example.vuln_type }} ({{ example.status }}) {% endif %} {% endif %}

{% if result.tool == 'Bandit' or result.tool == 'Ruff (SAST)' %} Defect ID: {{ example.test_id }} • Source Code Violation detected. {% elif result.tool == 'Semgrep' %} Defect ID: {{ example.test_id }} • Semgrep Pattern Match. {% elif result.tool == 'CodeQL' %} Rule: {{ example.test_id or example.rule_id }} • Static analysis finding; validate reachability and impact. {% elif result.tool == 'Safety' %} Affected Versions: {{ example.affected_versions }} • Fixed Versions: {{ example.fixed_versions }}
Description: {{ example.description }} {% elif result.tool == 'OSV Dependency Audit' %} CVSS Score: {{ example.cvss or 'N/A' }} • Summary: {{ example.summary }}
Details: {{ example.details[:300] }}{% if example.details|length > 300 %}...{% endif %} {% elif result.tool == 'Trivy' %} Severity: {{ example.severity }} • Title: {{ example.title or 'N/A' }}
Target Package: {{ example.package_name }} (Installed: {{ example.installed_version }}, Fixed in: {{ example.fixed_version }}) {% elif result.tool == 'Secrets Scanner' %} Secret Type: {{ example.type }} • Exposed plaintext credential detected. {% elif result.tool == 'YARA Scanner' %} Rule Name: {{ example.rule }} • Threat Profile: {{ example.description }} {% elif result.tool == 'ClamAV' %} Virus Name: {{ example.virus }} • Threat Profile: {{ example.description }} {% elif result.tool == 'Aegis DAST Probe' %} Vulnerability Type: {{ example.vuln_type }} • Status: {{ example.status }}
Attack Payload: {{ example.payload }} {% endif %}

{% if result.tool == 'Bandit' or result.tool == 'Ruff (SAST)' %} > TARGET_FILE: {{ example.filename }} • LINE_REF: {{ example.line_number }} {% elif result.tool == 'Semgrep' %} > TARGET_FILE: {{ example.filename }} • LINE_REF: {{ example.line_number }} {% elif result.tool == 'CodeQL' %} Source: {{ example.filename }}:{{ example.line_number }} {% elif result.tool == 'OSV Dependency Audit' %} > DEPENDENCY: {{ example.package_name }} (Version: {{ example.version }}) {% elif result.tool == 'Trivy' %} > TARGET: {{ example.target }} {% elif result.tool == 'Secrets Scanner' %} > TARGET_FILE: {{ example.filename }} • LINE_REF: {{ example.line_number }} {% elif result.tool == 'YARA Scanner' %} > TARGET_FILE: {{ example.filename }} {% elif result.tool == 'ClamAV' %} > TARGET_FILE: {{ example.filename }} {% elif result.tool == 'Aegis DAST Probe' %} > TARGET_ROUTE: {{ example.route }} {% endif %}

What failed

{{ example.test_id or example.id or example.vulnerability_id or example.rule or example.type or result.tool }}

Why it matters

How to fix

New or pre-existing

Safe to suppress

{% if example.fix_suggestion %}

Copyable fix

{{ example.fix_suggestion }}

{% endif %} {% if example.suppression_example %}

Suppression example

{{ example.suppression_example }}

{% endif %} {% if result.tool == 'CodeQL' and example.code_flows %}

Source-to-sink path {% for flow in example.code_flows %}

{{ step.filename }}:{{ step.line_number }} — {{ step.message }}

{% endfor %}

{% endif %}

{% if result.tool == 'OSV Dependency Audit' %} ⚠️ Open Source Vulnerability (OSV): This dependency version contains known security bugs cataloged in public vulnerability databases. Update to a patched version immediately. {% elif result.tool == 'Bandit' or result.tool == 'Semgrep' %} {% if 'subprocess' in example.issue_text.lower() or 'shell' in example.issue_text.lower() or 'rce' in example.test_id.lower() %} ⚠️ Command execution flaw: The code runs shell scripts using variables. A hacker can insert command punctuation (like ;) to run unauthorized server commands. {% elif 'sql' in example.issue_text.lower() or 'sqli' in example.test_id.lower() %} ⚠️ SQL Database Injection: Direct string formatting is used to build query structures. A hacker can submit trick keywords to bypass permissions and leak all data. {% elif 'eval' in example.issue_text.lower() or 'eval' in example.test_id.lower() %} ⚠️ Arbitrary execution: The system executes raw input as Python scripts (eval). A hacker can use this to execute files, delete folders, or read private environmental secrets. {% elif 'pickle' in example.issue_text.lower() or 'pickle' in example.test_id.lower() %} ⚠️ Deserialization risk: Pickle deserializes unsanitized streams. Hackers can bundle hidden programming payloads inside save streams that execute automatically when loaded. {% elif 'md5' in example.issue_text.lower() or 'hash' in example.issue_text.lower() or 'weak-hash' in example.test_id.lower() %} ⚠️ Weak encryption: Password files or sensitive states are hashed with MD5. MD5 is broken and easily reversed by modern graphic cards. Use SHA-256 or bcrypt instead. {% else %} ⚠️ Security weakness: Code contains insecure defaults or dangerous functions that make exploits easier. Fix by upgrading validation logic. {% endif %} {% elif result.tool == 'Safety' %} ⚠️ Outdated package dependency: This imported library contains known, public vulnerabilities listed in CVE catalogs. Fix by updating requirements.txt to the specified fixed version. {% elif result.tool == 'Trivy' %} ⚠️ Server Wrapper vulnerability: The target environment wrapper or docker base image contains open CVE patches. Hackers exploit these to escape server containers. {% elif result.tool == 'Secrets Scanner' %} ⚠️ Hardcoded plaintext secret: Plaintext credentials or api tokens detected. Exposed keys will be leaked if code is pushed to public repositories. Fix by loading credentials from secure env parameters. {% elif result.tool == 'YARA Scanner' %} ⚠️ Malicious code pattern: Match against custom signature definition rules (backdoors, shells, obfuscated executions). Ensure code origin is verified and remove suspicious components. {% elif result.tool == 'ClamAV' %} ⚠️ Active virus or malware signature detected in codebase. Remove the infected code or test file before staging. {% elif result.tool == 'Aegis DAST Probe' %} ⚠️ Active endpoint vulnerability: Aegis DAST probe successfully bypassed defenses and executed payload reflections. Enable Web Application Firewall (WAF) to block the attack vector. {% endif %}

{% endfor %} {% elif result.status == 'PASS' %}

No findings reported in this scan.

{% elif result.status == 'SKIPPED' or result.status == 'MISSING' %}

Not assessed by this scanner.

{% else %}

Scanner failed or report incomplete; coverage unavailable.

{% endif %}

{% endfor %}