Security Scanning for Bike4Mind

This document outlines our automated security scanning approach and how to interpret results.

Overview

We've implemented automated security scanning that runs weekly to identify potential security issues in our codebase, dependencies, and AWS infrastructure. The scanning includes:

1. Static Application Security Testing (SAST) with Semgrep
2. Dependency Scanning with npm/pnpm audit
3. Dynamic Application Security Testing (DAST) with OWASP ZAP
4. Infrastructure Scanning with Prowler (AWS) and Checkov (IaC)
5. Secret Detection with Gitleaks

Running Scans

Scans run automatically every Sunday at midnight UTC. You can also trigger a manual scan:

1. Go to GitHub Actions
2. Select "Weekly Security Scan" workflow
3. Click "Run workflow"

Local Setup for Developers

Secret Detection with Gitleaks

To prevent accidental secret commits, we use Gitleaks as a pre-commit hook. To set up:

# Run the installation script
bash install-hooks.sh

This script will:

• Install gitleaks if not already installed
• Configure git hooks to run before each commit
• Scan staged files for potential secrets
• Block commits that contain secrets

If you need to bypass the hook (for legitimate test data):

git commit --no-verify -m "your message"

To scan your entire codebase for secrets:

# Use the review secrets script
./review-secrets.sh

Interpreting Results

Security scan results are uploaded as artifacts in the GitHub Actions run. Here's how to interpret them:

Gitleaks Results

Gitleaks identifies secrets and credentials in your code. Common findings include:

• API keys and tokens
• Database connection strings
• Private keys and certificates
• Passwords and credentials
• AWS access keys

When Gitleaks blocks your commit:

1. Review the flagged content in your staged files
2. Remove or replace the sensitive information
3. Consider using SST Secrets or environment variables instead
4. Commit again after removing the secrets

Semgrep Results

Semgrep identifies code patterns that might lead to security vulnerabilities. Focus on:

• SQL injection vulnerabilities
• Cross-site scripting (XSS) issues
• Insecure direct object references
• Command injection possibilities

npm/pnpm Audit Results

These identify vulnerabilities in dependencies. Prioritize:

• Critical and high severity issues
• Vulnerabilities in production dependencies
• Issues with available fixes

OWASP ZAP Results

ZAP identifies runtime vulnerabilities in the application. Look for:

• Authentication and session management issues
• API vulnerabilities
• Cross-site scripting or CSRF issues

AWS Infrastructure (Prowler)

Prowler identifies AWS configuration issues. Key areas:

• S3 bucket permissions and encryption
• IAM role permissions (least privilege)
• Lambda function configurations
• CloudFront settings
• Secrets management

IaC (Checkov)

Checkov identifies issues in our infrastructure-as-code. Focus on:

• Resource configurations that deviate from best practices
• Permissions and access control issues
• Encryption settings

Remediation Process

1. Triage: Review findings and determine severity
2. Fix Critical Issues: Address high-impact findings immediately
3. Track: Create tickets for medium/low issues
4. Verify: Run scans again after fixes to confirm resolution

False Positives

If you identify false positives:

• For Gitleaks: Update your commit to remove the false detection or use --no-verify if necessary
• For Semgrep: Add to .semgrepignore or create rule exceptions
• For Prowler: Document in comments with justification
• For Checkov: Add #checkov:skip=CKV_AWS_123:Reason for exception in code

Best Practices for Secret Management

Instead of hardcoding secrets:

1. Use SST Secrets: secrets.VARIABLE_NAME
2. Use environment variables: process.env.VARIABLE_NAME
3. For client-side code, create API endpoints instead of using keys directly
4. Remove test/example secrets before committing

Questions?

Contact the security team or engineering leads with questions about scan results or remediation steps.