feat: add security depth — secret scanning, dependency vulns, report surface

- Add dependency_scanner.py with pip-audit integration (requirements/pyproject)
- Add scan_secrets_regex() to ast_parser.py for non-Python files (.env, YAML, JS)
- Add SecurityScanResult model to EngineeringReport with ast/secret/dep fields
- Wire secret_findings and dep_vulnerabilities into bug_detection_agent context
- Populate security_scan on EngineeringReport in analysis_service pipeline
- Add pip-audit==2.7.3 to requirements.txt

app/agents/bug_detection_agent.py

@@ -5,7 +5,8 @@ from app.tools.file_scanner import get_python_files, sanitize_for_prompt
 from app.core.llm import call_llm_for_json
 from app.core.prompts import BUG_DETECTION_PROMPT
 from app.models.issue import IssueReport, Bug, Warning, Suggestion
-from app.tools.ast_parser import scan_repository_security
+from app.tools.ast_parser import scan_repository_security, scan_secrets_regex
+from app.tools.dependency_scanner import scan_dependencies
 
 
 logger = get_logger(__name__)
@@ -22,6 +23,13 @@ async def run(local_path: str) -> IssueReport:
 
     # Step 1.5 - AST-based security scan (no LLM, zero cost, deterministic)
     ast_security_findings = scan_repository_security(local_path)
+    # Regex-based secret scan (covers non-Python files: .env, YAML, JS, etc.)
+    secret_findings = scan_secrets_regex(local_path)
+    logger.info("Secret scan complete", extra={"findings": len(secret_findings)})
+
+    # Dependency vulnerability scan
+    dep_vulnerabilities = scan_dependencies(local_path)
+    logger.info("Dependency scan complete", extra={"vulnerabilities": len(dep_vulnerabilities)})
     logger.info(
         "AST security scan complete",
         extra={"findings": len(ast_security_findings)},
@@ -59,6 +67,12 @@ Bandit Output:
 AST Security Findings:
 {chr(10).join(f"[{f['severity'].upper()}] {f['rule']} at line {f['line']} in {f['file']}: {f['detail']}" for f in ast_security_findings[:20])}
 
+Dependency Vulnerabilities:
+{chr(10).join(f"[VULN] {v['package']}=={v['version']} {v['id']}: {v['description'][:100]}" for v in dep_vulnerabilities[:10]) or "None found"}
+
+Secret Scan (non-Python files):
+{chr(10).join(f"[{f['severity'].upper()}] {f['rule']} at line {f['line']} in {f['file']}" for f in secret_findings[:10]) or "None found"}
+
 Test Results:
 Passed: {test_results["passed"]}
 Failed: {test_results["failed"]}

app/models/report.py

@@ -4,6 +4,14 @@ from app.models.issue import IssueReport
 from app.models.review import ReviewSuggestions, GeneratedTests, SpecialistReview
 
 
+class SecurityScanResult(BaseModel):
+    ast_findings: list[dict] = []
+    secret_findings: list[dict] = []
+    dependency_vulnerabilities: list[dict] = []
+    total_high: int = 0
+    total_critical: int = 0
+
+
 class EngineeringReport(BaseModel):
     repository: RepositoryMetadata
     issues: IssueReport
@@ -12,4 +20,5 @@ class EngineeringReport(BaseModel):
     full_report: str = ""
     generated_at: str = ""
     specialist_review: SpecialistReview | None = None
+    security_scan: SecurityScanResult = SecurityScanResult()
     from_cache: bool = False

app/services/analysis_service.py

@@ -24,6 +24,10 @@ from app.tools.github_tool import (
     delete_repository,
     resolve_remote_head_sha,
 )
+from app.models.report import SecurityScanResult
+from app.tools.ast_parser import scan_repository_security, scan_secrets_regex
+from app.tools.dependency_scanner import scan_dependencies
+
 
 logger = get_logger(__name__)
 
@@ -103,6 +107,23 @@ async def _run_pipeline(github_url: str) -> EngineeringReport:
         report = await report_generator_agent.run(
             metadata, issues, tests, review, specialist_review
         )
+        
+        # Already computed inside bug_detection_agent, but we surface them on the report too
+        # These are fast (no LLM) so re-running is acceptable
+        ast_findings = scan_repository_security(local_path)
+        secret_findings = scan_secrets_regex(local_path)
+        dep_vulns = scan_dependencies(local_path)
+
+        high = sum(1 for f in ast_findings + secret_findings if f.get("severity") == "high")
+        critical = sum(1 for f in ast_findings if f.get("severity") == "critical")
+
+        report.security_scan = SecurityScanResult(
+            ast_findings=ast_findings,
+            secret_findings=secret_findings,
+            dependency_vulnerabilities=dep_vulns,
+            total_high=high,
+            total_critical=critical,
+        )
         metrics.record_run(
             "report_generator_agent", time.monotonic() - _t, success=True
         )

app/tools/ast_parser.py

@@ -1,5 +1,6 @@
 import ast
 import os
+import re as _re
 from typing import Any
 
 
@@ -156,4 +157,44 @@ def scan_repository_security(local_path: str) -> list[dict]:
         for file in files:
             if file.endswith(".py"):
                 all_findings.extend(detect_security_issues(os.path.join(root, file)))
-    return all_findings
+    return all_findings
+
+
+_REGEX_SECRET_PATTERNS = [
+    (r"(?i)(api_key|apikey|api-key)\s*[=:]\s*['\"]([A-Za-z0-9_\-]{16,})['\"]", "hardcoded-api-key"),
+    (r"(?i)(secret|password|passwd|token|auth_token|access_token)\s*[=:]\s*['\"]([A-Za-z0-9_\-]{8,})['\"]", "hardcoded-secret"),
+    (r"(?i)-----BEGIN (RSA|EC|OPENSSH) PRIVATE KEY-----", "exposed-private-key"),
+    (r"(?i)(AWS_SECRET_ACCESS_KEY|GITHUB_TOKEN|SLACK_TOKEN)\s*[=:]\s*['\"]?([A-Za-z0-9/+=]{16,})['\"]?", "cloud-credential"),
+]
+
+_SCAN_EXTENSIONS = {".py", ".js", ".ts", ".env", ".yaml", ".yml", ".json", ".sh", ".cfg", ".ini"}
+
+
+def scan_secrets_regex(local_path: str) -> list[dict]:
+    """
+    Regex-based secret scan across all common file types (not just Python).
+    Complements the AST-based scanner which only covers Python.
+    """
+    findings: list[dict] = []
+    for root, dirs, files in os.walk(local_path):
+        dirs[:] = [d for d in dirs if d not in {".git", "__pycache__", ".venv", "venv", "node_modules"}]
+        for file in files:
+            ext = os.path.splitext(file)[1].lower()
+            if ext not in _SCAN_EXTENSIONS:
+                continue
+            file_path = os.path.join(root, file)
+            try:
+                with open(file_path, "r", encoding="utf-8", errors="ignore") as f:
+                    for lineno, line in enumerate(f, 1):
+                        for pattern, rule in _REGEX_SECRET_PATTERNS:
+                            if _re.search(pattern, line):
+                                findings.append({
+                                    "rule": rule,
+                                    "line": lineno,
+                                    "file": file_path,
+                                    "detail": f"Possible secret matched pattern '{rule}'",
+                                    "severity": "high",
+                                })
+            except Exception:  # nosec B110
+                pass
+    return findings

app/tools/dependency_scanner.py

@@ -0,0 +1,70 @@
+"""
+Dependency vulnerability scanner using pip-audit.
+Scans requirements.txt / pyproject.toml for known CVEs.
+Best-effort: returns empty list if pip-audit is not installed or fails.
+"""
+import json
+import subprocess  # nosec B404
+import os
+from app.core.logger import get_logger
+
+logger = get_logger(__name__)
+
+
+def scan_dependencies(local_path: str) -> list[dict]:
+    """
+    Run pip-audit on the repo and return a list of vulnerability dicts.
+    Each dict has: package, version, id, description, fix_versions.
+    Returns empty list if pip-audit unavailable or no manifest found.
+    """
+    # Find dependency manifest
+    manifest = None
+    for candidate in ["requirements.txt", "pyproject.toml", "setup.cfg"]:
+        full = os.path.join(local_path, candidate)
+        if os.path.exists(full):
+            manifest = full
+            break
+
+    if manifest is None:
+        logger.info("No dependency manifest found — skipping vulnerability scan")
+        return []
+
+    try:
+        result = subprocess.run(  # nosec B603 B607
+            ["pip-audit", "--requirement", manifest, "--format", "json", "--no-deps"],
+            capture_output=True,
+            text=True,
+            timeout=120,
+        )
+    except FileNotFoundError:
+        logger.warning("pip-audit not installed — skipping dependency scan")
+        return []
+    except subprocess.TimeoutExpired:
+        logger.warning("pip-audit timed out")
+        return []
+    except Exception as exc:
+        logger.warning("pip-audit failed", extra={"error": str(exc)})
+        return []
+
+    if result.returncode not in (0, 1):  # 0=clean, 1=vulns found, others=error
+        logger.warning("pip-audit error", extra={"stderr": result.stderr[:200]})
+        return []
+
+    try:
+        data = json.loads(result.stdout)
+    except json.JSONDecodeError:
+        return []
+
+    findings = []
+    for dep in data.get("dependencies", []):
+        for vuln in dep.get("vulns", []):
+            findings.append({
+                "package": dep.get("name", "unknown"),
+                "version": dep.get("version", "unknown"),
+                "id": vuln.get("id", ""),
+                "description": vuln.get("description", ""),
+                "fix_versions": vuln.get("fix_versions", []),
+            })
+
+    logger.info("Dependency scan complete", extra={"vulnerabilities": len(findings)})
+    return findings

requirements.txt

@@ -31,4 +31,6 @@ mypy==1.10.0
 
 # Async task queue
 celery==5.4.0
-redis==5.0.8
+redis==5.0.8
+
+pip-audit==2.7.3