File size: 2,122 Bytes
c4f5f25
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# Security Scanning Configuration for MediGuard AI

# Trivy configuration for container vulnerability scanning
# Save as: .trivy.yaml

format: "json"
output: "security-scan-report.json"
exit-code: "1"
severity: ["UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL"]
type: ["os", "library"]
ignore-unfixed: false
skip-dirs: ["/usr/local/lib/python3.13/site-packages"]
skip-files: ["*.md", "*.txt"]
cache-dir: ".trivy-cache"

# Security scanning targets
scans:
  containers:
    - name: "mediguard-api"
      image: "mediguard/api:latest"
      type: "image"
    
    - name: "mediguard-nginx"
      image: "mediguard/nginx:latest"
      type: "image"
    
    - name: "mediguard-opensearch"
      image: "opensearchproject/opensearch:latest"
      type: "image"
  
  filesystem:
    - name: "source-code"
      path: "./src"
      type: "fs"
      security-checks:
        - license
        - secret
        - config
  
  repository:
    - name: "git-repo"
      path: "."
      type: "repo"
      security-checks:
        - license
        - secret
        - config

# Custom security policies
policies:
  hipaa-compliance:
    description: "HIPAA compliance checks"
    rules:
      - id: "HIPAA-001"
        description: "No hardcoded credentials"
        pattern: "(password|secret|key|token)\\s*[:=]\\s*['\"][^'\"]{8,}['\"]"
        severity: "CRITICAL"
      
      - id: "HIPAA-002"
        description: "No PHI in logs"
        pattern: "(ssn|social-security|medical-record|patient-id)"
        severity: "HIGH"
      
      - id: "HIPAA-003"
        description: "Encryption required for sensitive data"
        pattern: "(encrypt|decrypt|cipher)"
        severity: "MEDIUM"

# Exclusions
exclude:
  paths:
    - "tests/*"
    - "docs/*"
    - "*.md"
    - "*.txt"
    - ".git/*"
  
  vulnerabilities:
    - "CVE-2021-44228"  # Log4j (not used)
    - "CVE-2021-45046"  # Log4j (not used)

# Reporting
reports:
  formats:
    - "json"
    - "sarif"
    - "html"
  
  output-dir: "security-reports"
  
  notifications:
    slack:
      webhook-url: "${SLACK_WEBHOOK_URL}"
      channel: "#security"
      on-failure: true