{% set report_total_issues = namespace(val=0) %} {% set report_total_blocking = namespace(val=0) %} {% for r in results %} {% set report_total_issues.val = report_total_issues.val + r.total_issues %} {% set report_total_blocking.val = report_total_blocking.val + r.blocking_issues %} {% endfor %}

Evidence package / Local workspace

Security assessment

Release decision, scanner evidence, and remediation guidance packaged for review and sharing.

Download dossier Download share bundle

Release gate {% if final_status == 'BLOCKED' %}Blocked{% else %}Passed{% endif %}

Blocking issues {{ report_total_blocking.val }}

Must be resolved or accepted before release.

Total findings {{ report_total_issues.val }}

Across {{ results | length }} scanner modules.

Exploitability {{ exploitability_score }}%

{% if exploitability_score > 75 %}High exposure{% elif exploitability_score > 40 %}Material exposure{% else %}Low exposure{% endif %}

🎓 EXECUTIVE SECURITY GLOSSARY

This report is compiled from automated security scanning tools checking the target codebase. If any severe vulnerabilities are found, the deployment gate blocks the release to ensure the live environment is not compromised.

🔍 BANDIT (Source Code Auditor) Scans Python files line-by-line looking for programmatic security errors (e.g. executing user inputs directly or using weak hashing).

📦 SAFETY (Third-Party Libraries) Checks the requirements dependency tree against a global database of known library vulnerabilities (CVEs) and warns if packages are outdated or recalled.

🐳 TRIVY (System/Container Wrapper) Scans server setups, operating system packages, and docker files for security gaps that would let hackers gain host machine access.

Security Modules Run

{% set total_issues = namespace(val=0) %} {% for r in results %} {% set total_issues.val = total_issues.val + r.total_issues %} {% endfor %} {{ total_issues.val }}

Total Vulnerabilities

{% set total_blocking = namespace(val=0) %} {% for r in results %} {% set total_blocking.val = total_blocking.val + r.blocking_issues %} {% endfor %} {{ total_blocking.val }}

Blocking Issues

{{ exploitability_score }}%

Exploitability Score

Upload Python script for audit

READY

Select a local Python (.py) script file to run a security audit scan on it.

Software bill of materials (SBOM)

CYCLONEDX_1.5

A Software Bill of Materials (SBOM) has been generated in CycloneDX v1.5 JSON format, mapping the full dependency inventory of third-party libraries used by this application.

DOWNLOAD_CYCLONEDX_SBOM

Scanner evidence

{% for result in results %}

{% if result.examples %} {% for example in result.examples %}

{% if example.severity %} {{ example.severity }} {% if result.tool == 'Bandit' or result.tool == 'Ruff (SAST)' %} {{ example.issue_text }} {% elif result.tool == 'Semgrep' %} {{ example.issue_text }} {% elif result.tool == 'Safety' %} Insecure Package: {{ example.package_name }} {% elif result.tool == 'OSV Dependency Audit' %} OSV Vulnerability: {{ example.id }} ({{ example.package_name }}) {% elif result.tool == 'Trivy' %} Vulnerability: {{ example.vulnerability_id }} ({{ example.package_name }}) {% elif result.tool == 'Secrets Scanner' %} Hardcoded Secret: {{ example.type }} {% elif result.tool == 'YARA Scanner' %} Malicious Pattern Matched: {{ example.rule }} {% elif result.tool == 'ClamAV' %} Malware Signature Matched: {{ example.virus }} {% elif result.tool == 'Aegis DAST Probe' %} Active DAST Alert: {{ example.vuln_type }} ({{ example.status }}) {% endif %} {% endif %}

{% if result.tool == 'Bandit' or result.tool == 'Ruff (SAST)' %} Defect ID: {{ example.test_id }} • Source Code Violation detected. {% elif result.tool == 'Semgrep' %} Defect ID: {{ example.test_id }} • Semgrep Pattern Match. {% elif result.tool == 'Safety' %} Affected Versions: {{ example.affected_versions }} • Fixed Versions: {{ example.fixed_versions }}
Description: {{ example.description }} {% elif result.tool == 'OSV Dependency Audit' %} CVSS Score: {{ example.cvss or 'N/A' }} • Summary: {{ example.summary }}
Details: {{ example.details[:300] }}{% if example.details|length > 300 %}...{% endif %} {% elif result.tool == 'Trivy' %} Severity: {{ example.severity }} • Title: {{ example.title or 'N/A' }}
Target Package: {{ example.package_name }} (Installed: {{ example.installed_version }}, Fixed in: {{ example.fixed_version }}) {% elif result.tool == 'Secrets Scanner' %} Secret Type: {{ example.type }} • Exposed plaintext credential detected. {% elif result.tool == 'YARA Scanner' %} Rule Name: {{ example.rule }} • Threat Profile: {{ example.description }} {% elif result.tool == 'ClamAV' %} Virus Name: {{ example.virus }} • Threat Profile: {{ example.description }} {% elif result.tool == 'Aegis DAST Probe' %} Vulnerability Type: {{ example.vuln_type }} • Status: {{ example.status }}
Attack Payload: {{ example.payload }} {% endif %}

{% if result.tool == 'Bandit' or result.tool == 'Ruff (SAST)' %} > TARGET_FILE: {{ example.filename }} • LINE_REF: {{ example.line_number }} {% elif result.tool == 'Semgrep' %} > TARGET_FILE: {{ example.filename }} • LINE_REF: {{ example.line_number }} {% elif result.tool == 'OSV Dependency Audit' %} > DEPENDENCY: {{ example.package_name }} (Version: {{ example.version }}) {% elif result.tool == 'Trivy' %} > TARGET: {{ example.target }} {% elif result.tool == 'Secrets Scanner' %} > TARGET_FILE: {{ example.filename }} • LINE_REF: {{ example.line_number }} {% elif result.tool == 'YARA Scanner' %} > TARGET_FILE: {{ example.filename }} {% elif result.tool == 'ClamAV' %} > TARGET_FILE: {{ example.filename }} {% elif result.tool == 'Aegis DAST Probe' %} > TARGET_ROUTE: {{ example.route }} {% endif %}

What failed

{{ example.test_id or example.id or example.vulnerability_id or example.rule or example.type or result.tool }}

Why it matters

How to fix

New or pre-existing

Safe to suppress

{% if example.fix_suggestion %}

Copyable fix

{{ example.fix_suggestion }}

{% endif %} {% if example.suppression_example %}

Suppression example

{{ example.suppression_example }}

{% endif %}

{% if result.tool == 'OSV Dependency Audit' %} ⚠️ Open Source Vulnerability (OSV): This dependency version contains known security bugs cataloged in public vulnerability databases. Update to a patched version immediately. {% elif result.tool == 'Bandit' or result.tool == 'Semgrep' %} {% if 'subprocess' in example.issue_text.lower() or 'shell' in example.issue_text.lower() or 'rce' in example.test_id.lower() %} ⚠️ Command execution flaw: The code runs shell scripts using variables. A hacker can insert command punctuation (like ;) to run unauthorized server commands. {% elif 'sql' in example.issue_text.lower() or 'sqli' in example.test_id.lower() %} ⚠️ SQL Database Injection: Direct string formatting is used to build query structures. A hacker can submit trick keywords to bypass permissions and leak all data. {% elif 'eval' in example.issue_text.lower() or 'eval' in example.test_id.lower() %} ⚠️ Arbitrary execution: The system executes raw input as Python scripts (eval). A hacker can use this to execute files, delete folders, or read private environmental secrets. {% elif 'pickle' in example.issue_text.lower() or 'pickle' in example.test_id.lower() %} ⚠️ Deserialization risk: Pickle deserializes unsanitized streams. Hackers can bundle hidden programming payloads inside save streams that execute automatically when loaded. {% elif 'md5' in example.issue_text.lower() or 'hash' in example.issue_text.lower() or 'weak-hash' in example.test_id.lower() %} ⚠️ Weak encryption: Password files or sensitive states are hashed with MD5. MD5 is broken and easily reversed by modern graphic cards. Use SHA-256 or bcrypt instead. {% else %} ⚠️ Security weakness: Code contains insecure defaults or dangerous functions that make exploits easier. Fix by upgrading validation logic. {% endif %} {% elif result.tool == 'Safety' %} ⚠️ Outdated package dependency: This imported library contains known, public vulnerabilities listed in CVE catalogs. Fix by updating requirements.txt to the specified fixed version. {% elif result.tool == 'Trivy' %} ⚠️ Server Wrapper vulnerability: The target environment wrapper or docker base image contains open CVE patches. Hackers exploit these to escape server containers. {% elif result.tool == 'Secrets Scanner' %} ⚠️ Hardcoded plaintext secret: Plaintext credentials or api tokens detected. Exposed keys will be leaked if code is pushed to public repositories. Fix by loading credentials from secure env parameters. {% elif result.tool == 'YARA Scanner' %} ⚠️ Malicious code pattern: Match against custom signature definition rules (backdoors, shells, obfuscated executions). Ensure code origin is verified and remove suspicious components. {% elif result.tool == 'ClamAV' %} ⚠️ Active virus or malware signature detected in codebase. Remove the infected code or test file before staging. {% elif result.tool == 'Aegis DAST Probe' %} ⚠️ Active endpoint vulnerability: Aegis DAST probe successfully bypassed defenses and executed payload reflections. Enable Web Application Firewall (WAF) to block the attack vector. {% endif %}

{% endfor %} {% else %}

No issues detected by this scanner daemon.

{% endif %}

{% endfor %}

{% if final_status == 'BLOCKED' %}Deployment blocked{% else %}Deployment passed{% endif %}

🎓 EXECUTIVE SECURITY GLOSSARY

Scanner evidence