Spaces:
Sleeping
Sleeping
File size: 2,122 Bytes
c4f5f25 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 | # Security Scanning Configuration for MediGuard AI
# Trivy configuration for container vulnerability scanning
# Save as: .trivy.yaml
format: "json"
output: "security-scan-report.json"
exit-code: "1"
severity: ["UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL"]
type: ["os", "library"]
ignore-unfixed: false
skip-dirs: ["/usr/local/lib/python3.13/site-packages"]
skip-files: ["*.md", "*.txt"]
cache-dir: ".trivy-cache"
# Security scanning targets
scans:
containers:
- name: "mediguard-api"
image: "mediguard/api:latest"
type: "image"
- name: "mediguard-nginx"
image: "mediguard/nginx:latest"
type: "image"
- name: "mediguard-opensearch"
image: "opensearchproject/opensearch:latest"
type: "image"
filesystem:
- name: "source-code"
path: "./src"
type: "fs"
security-checks:
- license
- secret
- config
repository:
- name: "git-repo"
path: "."
type: "repo"
security-checks:
- license
- secret
- config
# Custom security policies
policies:
hipaa-compliance:
description: "HIPAA compliance checks"
rules:
- id: "HIPAA-001"
description: "No hardcoded credentials"
pattern: "(password|secret|key|token)\\s*[:=]\\s*['\"][^'\"]{8,}['\"]"
severity: "CRITICAL"
- id: "HIPAA-002"
description: "No PHI in logs"
pattern: "(ssn|social-security|medical-record|patient-id)"
severity: "HIGH"
- id: "HIPAA-003"
description: "Encryption required for sensitive data"
pattern: "(encrypt|decrypt|cipher)"
severity: "MEDIUM"
# Exclusions
exclude:
paths:
- "tests/*"
- "docs/*"
- "*.md"
- "*.txt"
- ".git/*"
vulnerabilities:
- "CVE-2021-44228" # Log4j (not used)
- "CVE-2021-45046" # Log4j (not used)
# Reporting
reports:
formats:
- "json"
- "sarif"
- "html"
output-dir: "security-reports"
notifications:
slack:
webhook-url: "${SLACK_WEBHOOK_URL}"
channel: "#security"
on-failure: true
|