h-l S r SSKJrJrJrJrJrJrJr SSK J
r
SSK J r SSK
JrJrJr SSKJrJr SSKrSSKrSSKrSSKrSSKJrJrJr SSKrSS K J r \ " 5 \" \ 5 r \R@ " S
S 5 \ RB S
' \R@ " S S
5 \ RB S' S\ RB S' \
" \ 5 r"\ " \ \"5 r#\RH " \RJ S9 \RL " \ 5 r'SSK(J)r)J*r*J+r+J,r,J-r- SSK.J/r/ \/" \ 5 SSK0J1r1 \ Re \1SS9 " S S5 r3 " S S5 r4\4" 5 r5\ Rm S5 S 5 r7\ Rm S 5 \S 5 5 r8\ Rm S S S!/S"9\S# 5 5 r9\ Rm S$5 \S% 5 5 r:\ Rm S&5 \S' 5 5 r;\ Rm S(5 \S) 5 5 r<\ Rm S*5 \S+ 5 5 r=\ R} S,5 S- 5 r?\ R} S.5 S/ 5 r@\ S0:X a; \ R 5 \"R 5 SSS5 \ R S1S2S3S49 gg! , ( d f N!= f)5z
DevSecOps Pipeline Security Maturity Assessor
Main Flask application for assessing CI/CD pipeline security maturity.
Author: Mitchele Jebet
License: MIT
)Flaskrequestjsonifyrender_templateflashredirecturl_for)
SQLAlchemy)Migrate) LoginManagerlogin_required current_user)datetimetimezoneN)DictListAny) load_dotenv
SECRET_KEYz dev-key-change-in-production DATABASE_URLz sqlite:///devsecops_assessor.dbSQLALCHEMY_DATABASE_URIF SQLALCHEMY_TRACK_MODIFICATIONS)level)User Organization
Assessment SubscriptionInvoice) init_auth)
billing_bpz/billing)
url_prefixc \ rS rSrSrSS/ SQS.SS/ S QS.S
S/ S QS.S S/ S
QS.SS/ SQS.SS/ SQS.S.rSSS.SSS.SSS.SS S.S S S.S .r\S \S!\ 4S" j5 r
S#r g$)%SecurityMaturityFramework4 z/Core framework for assessing DevSecOps maturityzSource Code Securityg?)dependency_scanningsecret_detection
sast_toolscode_quality_gates)nameweightcheckszBuild Securityg333333?)secure_build_environmentartifact_signingbuild_reproducibilitysupply_chain_securityzDeployment Security)infrastructure_as_codecontainer_scanningdeployment_approval_gatesenvironment_isolationzRuntime Security)monitoring_loggingincident_responsevulnerability_managementsecurity_testingzCompliance & Governance)policy_as_code audit_trailscompliance_reportingaccess_controlszCulture & Trainingg?)security_championstraining_programssecurity_reviewsknowledge_sharing)source_code_securitybuild_securitydeployment_securityruntime_securitycompliance_governanceculture_trainingInitialz,Ad-hoc security practices, reactive approach)r) description
Developingz Basic security tools implementedDefinedz+Documented security processes and standardsManagedz$Metrics-driven security improvements Optimizedz/Continuous security optimization and innovation)r scorereturnc n US: a SnO US: a SnOUS: a SnO US: a SnOS nX R U 4$ )
z'Calculate maturity level based on scoreZ rO K rN < rM ( rL r )MATURITY_LEVELS)clsrP r s $/home/kali/devsecops-assessor/app.pycalculate_maturity_level2SecurityMaturityFramework.calculate_maturity_level~ sM B;E
b[E
b[E
b[EE))%000 N) __name__
__module__ __qualname____firstlineno____doc__
CATEGORIESrW classmethodfloattuplerZ __static_attributes__r] r\ rY r# r# 4 s 9 + !
%
*
'
. "
)
g=J@ .\ ] 1S T .[ \ .T U 0a b O
1U
1u
1
1r\ r# c \ rS rSrSrS rSS\S\S\\\4 4S jjr SS\S\S\\\4 4S jjr
S
\\\4 S\\\4 4S jr S
\\\4 S\\\4 4S jr S
\\\4 S\\\4 4S
jr
S
\\\4 S\\\4 4S jrS
\\\4 S\\\4 4S jrS
\\\4 S\\\4 4S jrS
\\\4 S\\\4 4S jrS\\\4 S\\\4 4S jrSrg)PipelineAnalyzer z.Analyzes CI/CD pipelines for security maturityc " [ 5 U l g N)r# framework)selfs rY __init__PipelineAnalyzer.__init__ s 24r\ Nrepo_urltokenrQ c UR SS5 R S5 nUS US pT0 nU( a SU 3US' SU SU S 3n[ R " XvS
9nUR S :w a S S
UR 30$ UR 5 n 0 n
U H n U S R
S5 ( d M [ R " U S 5 n U R S :X d MI [ R " U R 5 n
U R U
5 XS ' M U R U
5 $ ! [ a8 n[ R S[ U5 35 S [ U5 0s SnA$ SnAff = f)z Analyze GitHub Actions pipelinezhttps://github.com/ /r rL ztoken
Authorizationz https://api.github.com/repos/z/contents/.github/workflowsheaders errorz Failed to access repository: r) )z.ymlz.yaml download_urlz!Error analyzing GitHub pipeline: N)replacesplitrequestsget status_codejsonendswithyaml safe_loadtext_analyze_workflow_content_calculate_overall_scores Exceptionloggerrz str)rn rq rr partsownerreporx
workflows_urlresponse workflowsanalysis_results
workflow_filecontent_responseworkflow_contentes rY analyze_github_pipeline(PipelineAnalyzer.analyze_github_pipeline sk ! % $$%:B?EEcJE (E!H4 G-3E7+;( >:J:O:O+P(BFB`B`aqBr(v)>?
"+ 112BC C % LL UR SS5 R SS5 n0 nU( a X$S' SU S3n[ R " XTS9nUR S :w a SU S
3n[ R " XTS9nUR S :w a S S UR 30$ [ R
" UR 5 nS
U R U5 0nU R U5 $ ! [ a8 n [ R S[ U 5 35 S [ U 5 0s Sn A $ Sn A ff = f)zAnalyze GitLab CI pipelinezhttps://gitlab.com/rt ru z%2Fz
PRIVATE-TOKENz#https://gitlab.com/api/v4/projects/z-/repository/files/.gitlab-ci.yml/raw?ref=mainrw ry z//repository/files/.gitlab-ci.yml/raw?ref=masterrz z!Failed to access .gitlab-ci.yml: z
gitlab-ci.ymlz!Error analyzing GitLab pipeline: N)
r| r~ r r r r r r r r r rz r )
rn rq rr project_pathrx file_urlr pipeline_contentr r s
rY analyze_gitlab_pipeline(PipelineAnalyzer.analyze_gitlab_pipeline s %#++,A2FNNsTYZLG+0( =\NJwxH ||H>H##s* @ N}~#<<B##s* #DXEYEYDZ![\\ #~~hmm < /1O1OP`1a b 112BC C % LL$>w$G ! *.)H)H)Q%& '+&B&B7&K"# ,0+L+LW+U'( '+&B&B7&K"#r\ c | ^ SnSn/ n/ n[ U5 R 5 m / SQn[ U 4S jU 5 5 ( a US-
nUR S5 OUR S5 / SQn[ U 4S jU 5 5 ( a US-
nUR S
5 OUR S 5 / S Qn[ U 4S
jU 5 5 ( a US-
nUR S5 OUR S5 [ U 4S jS 5 5 ( a US-
nUR S5 OUR S5 UUUUS.$ )z$Check source code security practicesr r )z npm auditz
yarn auditz pip-auditsafetysnyk
dependabotc 3 , ># U H oT; v M g 7frl r] .0tool content_strs rY ?PipelineAnalyzer._check_source_code_security.. s @/?t{"/? u ✅ Dependency scanning detectedu4 🔧 Add dependency scanning (npm audit, Snyk, etc.))
trufflesecgitleakszdetect-secretsz git-secretsc 3 , ># U H oT; v M g 7frl r] r s rY r r s <|t{"|r u ✅ Secret detection configuredu 🔧 Add secret detection tools) sonarqubecodeqlsemgrepbanditeslintc 3 , ># U H oT; v M g 7frl r] r s rY r r s :zt{"zr u4 ✅ Static Analysis Security Testing (SAST) detectedu 🔧 Implement SAST toolsc 3 , ># U H oT; v M g 7frl r] )r gater s rY r r s i/ht{"/hr )z quality gatez
security gatezfail on threshold u ✅ Quality gates configuredu 🔧 Add security quality gatesr r loweranyappend)
rn r rP r r r dependency_tools secret_toolsr' r s
@rY r ,PipelineAnalyzer._check_source_code_security s6 'l((* d @/?@ @ @ RKE OO > ? " "#Y Z S <|< < < RKE OO = > " "#D E L
:z: : : RKE OO R S " "#> ? i/hi i i RKE OO : ; " "#D E " .
r\ c d ^ SnSn/ n/ n[ U5 R 5 m[ U4S jS 5 5 ( a US-
nUR S5 OUR S5 [ U4S jS 5 5 ( a US
-
nUR S 5 OUR S 5 [ U4S
jS 5 5 ( a US-
nUR S5 OUR S5 [ U4S jS 5 5 ( a US-
nUR S5 OUR S5 UUUUS.$ )z Check build security practicesr r c 3 , ># U H oT; v M g 7frl r] r keywordr s rY r 9PipelineAnalyzer._check_build_security..2 s g5f'+%5fr )zruns-on: ubuntu-latestzimage: containerr u+ ✅ Containerized/managed build environmentu# 🔧 Use managed build environmentsc 3 , ># U H oT; v M g 7frl r] r s rY r r 9 s U/Tt{"/Tr )cosignsigstoregpgsignr u ✅ Artifact signing detectedu 🔧 Implement artifact signingc 3 , ># U H oT; v M g 7frl r] r s rY r r @ s K/Jt{"/Jr )sbomsyftcycloneu0 ✅ Software Bill of Materials (SBOM) generationu( 🔧 Generate Software Bill of Materialsc 3 , ># U H oT; v M g 7frl r] r s rY r r G s Q5P'+%5Pr )cachelockpinnedr u+ ✅ Build reproducibility measures detectedu3 🔧 Implement build caching and dependency pinningr r rn r rP r r r r s @rY r &PipelineAnalyzer._check_build_security( s% 'l((* g5fg g g RKE OO I J " "#H I U/TU U U RKE OO ; < " "#D E K/JK K K RKE OO N O " "#M N Q5PQ Q Q RKE OO I J " "#X Y " .
r\ c d ^ SnSn/ n/ n[ U5 R 5 m[ U4S jS 5 5 ( a US-
nUR S5 OUR S5 [ U4S jS 5 5 ( a US
-
nUR S 5 OUR S 5 [ U4S
jS 5 5 ( a US
-
nUR S5 OUR S5 [ U4S jS 5 5 ( a US-
nUR S5 OUR S5 UUUUS.$ )z#Check deployment security practicesr r c 3 , ># U H oT; v M g 7frl r] r s rY r >PipelineAnalyzer._check_deployment_security..^ s d/ct{"/cr ) terraformcloudformationpulumiansibler u# ✅ Infrastructure as Code detectedu% 🔧 Implement Infrastructure as Codec 3 , ># U H oT; v M g 7frl r] r s rY r r e s Z/Yt{"/Yr )trivyclairanchore twistlockr u ✅ Container security scanningu$ 🔧 Add container security scanningc 3 , ># U H oT; v M g 7frl r] r s rY r r l s e5d'+%5dr ) environmentapprovalmanualreviewu ✅ Deployment approval processu# 🔧 Implement deployment approvalsc 3 , ># U H oT; v M g 7frl r] r s rY r r s ^5]'+%5]r )staging
productiondevtestr u# ✅ Environment separation detectedu+ 🔧 Implement proper environment isolationr r r s @rY r +PipelineAnalyzer._check_deployment_securityT s% 'l((* d/cd d d RKE OO A B " "#J K Z/YZ Z Z RKE OO = > " "#I J e5de e e RKE OO = > " "#H I ^5]^ ^ ^ RKE OO A B " "#P Q " .
r\ c ^ SnSn/ n/ n[ U5 R 5 m[ U4S jS 5 5 ( a US-
nUR S5 OUR S5 [ U4S jS 5 5 ( a US
-
nUR S 5 OUR S 5 [ U4S
jS 5 5 ( a US
-
nUR S5 OUR S5 UUUUS.$ )z Check runtime security practicesr r c 3 , ># U H oT; v M g 7frl r] r s rY r ;PipelineAnalyzer._check_runtime_security.. s j/it{"/ir )datadognewrelicelasticsplunk
prometheusr u% ✅ Monitoring and logging configuredu' 🔧 Implement comprehensive monitoringc 3 , ># U H oT; v M g 7frl r] r s rY r r s g/ft{"/fr )zapburpdast penetrationz
security test# u ✅ Dynamic security testingu( 🔧 Add dynamic security testing (DAST)c 3 , ># U H oT; v M g 7frl r] r s rY r r s a5`'+%5`r )
vulnerabilitycvepatchupdateu$ ✅ Vulnerability management processu' 🔧 Implement vulnerability managementr r r s @rY r (PipelineAnalyzer._check_runtime_security s 'l((* j/ij j j RKE OO C D " "#L M g/fg g g RKE OO : ; " "#M N a5`a a a RKE OO B C " "#L M " .
r\ c d ^ SnSn/ n/ n[ U5 R 5 m[ U4S jS 5 5 ( a US-
nUR S5 OUR S5 [ U4S jS 5 5 ( a US
-
nUR S 5 OUR S 5 [ U4S
jS 5 5 ( a US-
nUR S5 OUR S5 [ U4S jS 5 5 ( a US-
nUR S5 OUR S5 UUUUS.$ )z)Check compliance and governance practicesr r c 3 , ># U H oT; v M g 7frl r] r s rY r @PipelineAnalyzer._check_compliance_governance.. s [/Zt{"/Zr )opa
gatekeeperpolicyconftestr
u! ✅ Policy as Code implementationu 🔧 Implement Policy as Codec 3 , ># U H oT; v M g 7frl r] r s rY r r s Y5X'+%5Xr )auditlogtracerecordr u ✅ Audit trail capabilitiesu& 🔧 Enable comprehensive audit trailsc 3 , ># U H oT; v M g 7frl r] r s rY r r s f5e'+%5er )report
compliancesocgdprhipaar u! ✅ Compliance reporting detectedu 🔧 Add compliance reportingc 3 , ># U H oT; v M g 7frl r] r s rY r r r r )rbac
permissionroleaccessu ✅ Access control measuresu% 🔧 Implement proper access controlsr r r s @rY r -PipelineAnalyzer._check_compliance_governance s% 'l((* [/Z[ [ [ RKE OO ? @ " "#B C Y5XY Y Y RKE OO : ; " "#K L f5ef f f RKE OO ? @ " "#B C ^5]^ ^ ^ RKE OO 9 : " "#J K " .
r\ c & SnSnS/n/ SQnUUUUS.$ )z%Check culture and training indicators2 r u0 ℹ️ Culture assessment requires manual review)u) 🔧 Establish security champions programu) 🔧 Implement security training programsu$ 🔧 Regular security design reviewsr r] )rn r rP r r r s rY r (PipelineAnalyzer._check_culture_training s3 FG
" .
r\ r c SU; a U$ 0 nSnU R R R 5 HR u pESnSnUR 5 H u pXI; d M XiU S -
nUS-
nM US: d M@ Xg- n
XU' X:US - -
nMT U R R U5 u p[ US5 U U UU[
R " [ R 5 R 5 S.$ )z!Calculate weighted overall scoresrz r rP rL r* rM )
overall_scorematurity_level
maturity_infocategory_scoresdetailed_resultsanalysis_timestamp)
rm rc itemsrZ roundr nowr utc isoformat)
rn r r0 overall_weighted_scorer configcategory_totalcategory_count
workflow_nameworkflow_results category_avgr. r/ s
rY r *PipelineAnalyzer._calculate_overall_scores s & &# # !" !% 9 9 ? ? A H N N3C3I3I3K/
/"x&@&IIN"a'N 4L
! - > ,8)&9I*II& !B )-(O(OPf(g% ##91 = , * . 0"*,,x||"<"F"F"H
r\ )rm rl )r^ r_ r` ra rb ro r r r r r r r r r r r r r rg r] r\ rY ri ri sx 85#% #%C #%4PSUXPX> #%J % %C %4PSUXPX> %> c3h DcN B-
4S> -
d3PS8n -
^*
T#s(^ *
S#X *
X*
$sCx. *
T#s(^ *
X#
tCH~ #
$sCx. #
J*
DcN *
tCQTH~ *
X
tCH~
$sCx.
$!
$sCx. !
TRUWZRZ^ !
r\ ri ru c j [ R ( a [ [ S5 5 $ [ S5 $ )z Home page dashboardz landing.html)r is_authenticatedr r r r] r\ rY indexrC
s( $$ ,-- > **r\ z
/dashboardc @ [ R n [ R R U R
S9R
5 n[ R R [ R R [ R 5 5 R U R
S9R 5 nU( a [ US5 OSn/ n[ R R U R
S9R [ R R! 5 5 R# 5 nU( aT UR$ ( aC [& R( " UR$ 5 nSU; a [+ US R- 5 5 nUUUS.n[ R R U R
S9R [ R R! 5 5 R1 S5 R3 5 n[5 SXxS9$ ! [& R. a Nf = f) zDashboard pageorganization_idrM r r0 )total_assessments
average_scorer0 zdashboard.html)statsrecent_assessments)r organizationr query filter_byidcountdbsessionfuncavgr- scalarr4 order_by
created_atdescfirstassessment_datar loadslistvaluesJSONDecodeErrorlimitallr ) orgrG avg_score_query avg_scorer0 recent_assessmentrZ rJ rK s rY rA rA s
#
#C #((223662JPPRjj&&rww{{:3K3K'LMWWhkhnhnWovvxO-<oq)!I O"((223662JSST^TiTiTnTnTpqwwy . > > "jj):)J)J KO O3"&7H'I'P'P'R"S
/"*
E $))33CFF3KTTU_UjUjUoUoUqrxxyz{ B +5 `` ## s AH H H z/assessment/newGETPOST)methodsc ` [ R S:X Ga[ [ R ( a [ R " 5 O[ R n [
R nU R SS5 R 5 nU R SS5 R 5 nU R SS5 R 5 nU R SS5 R 5 n[ X#U/5 ( d [ SS05 S 4$ UR 5 ( d [ SS
05 S 4$ US :X a [ R X55 nO+US
:X a [ R X55 nO[ SS05 S 4$ SU; a [ SUS 05 S 4$ [ UR UUUUS US S R# 5 [$ R& " U5 S9n[( R* R- U5 U=R. S-
sl [( R* R1 5 [ R ( a [ UR US.5 $ [3 SS5 [5 [7 SUR S95 $ [C S 5 $ ! [8 a n[: R= S[? U5 35 [( R* RA 5 [ R ( a [ S[? U5 05 S4s SnA$ [3 S [? U5 3S5 [5 [7 S 5 5 s SnA$ SnAff = f) zCreate new assessmentrf project_namert repository_urlplatformrr rz zAll fields are requiredi z Monthly assessment limit reached githubgitlabzUnsupported platformr- r/ r) )rF r) rj rk r- r. rZ rL )
assessment_idr z"Assessment completed successfully!successview_assessment)ro zError creating assessment: NzError: new_assessmentznew_assessment.html)"r methodis_jsonget_jsonformr rL r stripr` r can_create_assessmentanalyzerr r r rO r r dumpsrQ rR addmonthly_assessments_usedcommitr r r r r rz r rollbackr ) datarL ri rq rk rr r
assessmentr s rY rs rs 2 s ~~ @ ;)0 7##%gllD (44L 88NB7==?Lxx 0"5;;=Hxx
B/557HHHWb)//1E 9:: )B CDcII 5577 )K LMsRR 8#"::8KX%"::8K )? @A3FF'! )9 :;S@@ $ ,! '! %o 6 & 7 ? E E G $
7 3J
JJNN: &
1 1Q 6 1 JJ %/]] &
:IF (9 WXX 0 11 ; LL6s1vh? @ JJ ! Q 01366Ax('2 (8 9:: ;sK C*I< #I< &AI< -I< CI< (I< <
L-A+L(1L-7+L("L-(L-z /assessment/c $ [ R R U 5 nUR [ R :w a [ SS5 [
[ S5 5 $ [ R " UR 5 n[ SUU[ 5 S9$ )zView assessment resultszAccess denied.rz rA zassessment_results.html)r r rm )
r rM
get_or_404rF r r r r r r[ rZ r r# ro r r s rY rq rq { s} !!,,];J !!\%A%AA
( ,--jj334G 4$.!(#<#> @ @r\ z/assessment/listc [ R R [ R S9R [ R R 5 5 R 5 n [ SU S9$ )z)List all assessments for the organizationrE zassessment_list.html assessments)
r rM rN r rF rV rW rX r` r r s rY list_assessmentsr sU "",,\=Y=Y,Z"*(:+@+@+E+E+G"H 1{ KKr\ z#/api/assessment/c [ R R U 5 nUR [ R :w a [ SS05 S4$ [ R " UR 5 n[ UR UR UR R UR UR UR UR UR R# 5 US. 5 $ )z API endpoint for assessment datarz z
Access deniedrl ) rO ri rL rj rk r- r. rW r )r rM r rF r r r r[ rZ rO r) rL rj rk r- r. rW r7 r s rY api_assessmentr s !!,,];J !!\%A%AA 12C77jj334G mm""//44$33 ''#11$33 ++557
r\ z /api/organizations/assessmentsc [ R n [ R R U R
S9R
[ R R 5 5 R 5 n[ U R U Vs/ s HK nUR
UR UR UR UR R 5 S.PMM snS.5 $ s snf )z)API endpoint for organization assessmentsrE )rO ri r- r. rW )rL r )r rL r rM rN rO rV rW rX r` r r) r- r. r7 )rL r as rY api_org_assessmentsr s ,,L "",,\__,M"*(:+@+@+E+E+G"H $)) !
!
dd !!" "#"2"2 ll 4 4 6
!
s AC
c [ SSSS9S4$ )N
error.htmlr zPage not found
error_code
error_message)r rz s rY not_foundr s <$''7 9:= > >r\ rr c X [ R R 5 [ SSSS9S4$ )Nr rr zInternal server errorr )rQ rR r r r s rY internal_errorr s2 JJ <$''> @AD E Er\ __main__Tz0.0.0.0i )debughostport)Drb flaskr r r r r r r flask_sqlalchemyr
flask_migrater flask_loginr r
r r r osr r r~ typingr r r loggingdotenvr r^ appgetenvr9 rQ migrate basicConfigINFO getLoggerr modelsr r r r r authr billingr register_blueprintr# ri rz routerC rA rs rq r r r errorhandlerr r app_context
create_allrunr] r\ rY r s U T T ' ! B B ' " "
Ho 99\3QR
< (* .Bc(d
$ %/4
+ , _
#r
',, ' 8 $ I H # zj 9X1 X1tv
v
r 3 + + < a a> ufo6E2 7E2N ,-@ .@ L L 01 2, +, -* #> >
#E E z
GG$YTG2
s I//
I=