🔍 Spotter-SAST v2.1.0: Enterprise Security Analysis Platform

npm install

pip install -r requirements.txt

cp .env.example .env

# Organization Configuration
ORGANIZATION_INDUSTRY=general          # healthcare, finance, ecommerce, government, general
ORGANIZATION_NAME=Your Organization
CONTACT_EMAIL=compliance@yourorg.com

# Security Configuration
JWT_SECRET=your-secure-jwt-secret
ENABLE_RBAC=true
ENABLE_AUDIT_LOGGING=true

# Enhanced Compliance Features
ENABLE_ENHANCED_COMPLIANCE=true
ENABLE_COMPLIANCE_DRIFT_DETECTION=true
ENABLE_MULTI_TENANT_MANAGEMENT=true
ENABLE_EVIDENCE_COLLECTION=true
ENABLE_AUTOMATED_REMEDIATION=true
ENABLE_ADVANCED_ANALYTICS=true

# Framework-Specific (auto-enabled based on ORGANIZATION_INDUSTRY)
ENABLE_HIPAA=false
ENABLE_GDPR=false
ENABLE_PCI_DSS=false
ENABLE_ISO27001=false
ENABLE_SOX=false
ENABLE_NIST_CSF=true

npm start

{
  "filepath": "/path/to/file.js",
  "tools": ["semgrep", "eslint"],
  "policies": ["owasp", "pci"],
  "includeFixSuggestions": true,
  "user_token": "jwt-token"
}

{
  "dirpath": "/path/to/project",
  "enableMonitoring": true,
  "schedule": "0 */6 * * *",
  "policies": ["owasp", "enterprise_security"]
}

{
  "filepath": "/path/to/code",
  "frameworks": ["hipaa", "gdpr", "pci_dss"],
  "industry": "healthcare",
  "include_recommendations": true
}

{
  "action": "enable",
  "framework": "hipaa",
  "industry": "healthcare"
}

{
  "project_path": "./src",
  "frameworks": ["hipaa", "gdpr"],
  "baseline_name": "production_baseline"
}

{
  "project_path": "./src",
  "frameworks": ["hipaa", "gdpr"]
}

{
  "tenant_id": "acme_healthcare",
  "tenant_config": {
    "name": "ACME Healthcare",
    "industry": "healthcare",
    "template": "healthcare_hipaa",
    "riskTolerance": "zero"
  }
}

{
  "tenant_id": "acme_healthcare",
  "project_path": "./patient_portal"
}

{
  "scan_path": "./src",
  "frameworks": ["hipaa", "pci"],
  "collector": "security@company.com",
  "notes": "Pre-deployment compliance scan"
}

{
  "frameworks": ["hipaa", "pci"],
  "time_range": {
    "start": "2024-01-01T00:00:00Z",
    "end": "2024-12-31T23:59:59Z"
  },
  "report_format": "detailed"
}

{
  "finding": {
    "type": "hardcoded_secrets",
    "severity": "Critical",
    "file": "./config/database.js"
  },
  "framework": "hipaa",
  "automation_level": "semi_automatic"
}

{
  "time_range": {
    "start": "2024-01-01T00:00:00Z",
    "end": "2024-12-31T23:59:59Z"
  },
  "frameworks": ["hipaa", "gdpr", "pci"],
  "include_predictions": true
}

{
  "filepath": "/path/to/file.js",
  "strategy": "balanced",
  "validate_fixes": true,
  "create_backup": true
}

{
  "project_path": "/path/to/project",
  "schedule": "0 */6 * * *",
  "alert_thresholds": {
    "critical": 0,
    "high": 5
  }
}

{
  "time_range": "24h",
  "include_trends": true,
  "include_alerts": true
}

{
  "scan_path": "/path/to/project",
  "report_dir": "./reports",
  "format": "sarif",
  "include_executive_summary": true,
  "include_compliance_matrix": true
}

{
  "action": "check",
  "policy_name": "owasp",
  "scan_results": {...}
}

{
  "vuln_type": "sql_injection"
}

# 1. Configure for healthcare industry
echo "ORGANIZATION_INDUSTRY=healthcare" >> .env
echo "ENABLE_HIPAA=true" >> .env
echo "ENABLE_NIST_CSF=true" >> .env

# 2. Register healthcare tenant
echo '{
  "tenant_id": "acme_medical",
  "tenant_config": {
    "name": "ACME Medical Center",
    "industry": "healthcare",
    "template": "healthcare_hipaa",
    "riskTolerance": "zero",
    "complianceOfficer": "Dr. Sarah Johnson",
    "contactEmail": "compliance@acmemedical.com"
  }
}' | node src/server.js register_compliance_tenant

# 3. Create compliance baseline
echo '{
  "project_path": "./patient-portal",
  "frameworks": ["hipaa", "nist"],
  "baseline_name": "patient_portal_baseline"
}' | node src/server.js compliance_drift_baseline

# 4. Perform HIPAA compliance scan
echo '{
  "tenant_id": "acme_medical",
  "project_path": "./patient-portal"
}' | node src/server.js tenant_compliance_assessment

# Configure for financial industry
echo "ORGANIZATION_INDUSTRY=finance" >> .env
echo "ENABLE_PCI_DSS=true" >> .env
echo "ENABLE_SOX=true" >> .env

# Register financial tenant with strict controls
echo '{
  "tenant_id": "banking_corp",
  "tenant_config": {
    "name": "Banking Corporation",
    "industry": "finance", 
    "template": "financial_pci",
    "riskTolerance": "minimal"
  }
}' | node src/server.js register_compliance_tenant

# Configure for e-commerce
echo "ORGANIZATION_INDUSTRY=ecommerce" >> .env
echo "ENABLE_PCI_DSS=true" >> .env
echo "ENABLE_GDPR=true" >> .env
echo "ENABLE_CCPA=true" >> .env

# 1. Perform comprehensive scan
node src/server.js enhanced_scan_directory ./src

# 2. Collect cryptographic evidence
echo '{
  "scan_path": "./src",
  "frameworks": ["hipaa", "gdpr"],
  "collector": "audit@company.com",
  "notes": "Quarterly compliance audit scan"
}' | node src/server.js collect_compliance_evidence

# 3. Generate audit report
echo '{
  "frameworks": ["hipaa", "gdpr"],
  "time_range": {"start": "2024-01-01T00:00:00Z", "end": "2024-12-31T23:59:59Z"},
  "report_format": "detailed"
}' | node src/server.js generate_compliance_audit_report

# Trigger HIPAA violation remediation
echo '{
  "finding": {
    "type": "hardcoded_secrets",
    "severity": "Critical",
    "file": "./config/database.js",
    "line": 15
  },
  "framework": "hipaa",
  "automation_level": "semi_automatic",
  "stakeholders": ["security-team", "compliance-officer"]
}' | node src/server.js trigger_compliance_remediation

# Start real-time monitoring with compliance checking
echo '{
  "project_path": "./production-app",
  "schedule": "0 */2 * * *",
  "alert_thresholds": {"critical": 0, "high": 1}
}' | node src/server.js start_continuous_monitoring

# Monitor compliance drift
echo '{
  "project_path": "./production-app",
  "frameworks": ["hipaa", "pci_dss"]
}' | node src/server.js compliance_drift_detect

🛡️ Enhanced SAST Compliance Report
📂 Scanned: /healthcare-app
🏛️ Frameworks: hipaa, gdpr, nist_csf
📊 Overall Status: NON_COMPLIANT  
🎯 Average Score: 73.5%

📋 Framework Results:
   ❌ HIPAA: FAIL (65.2%)
      Violations: 164.312(a)(2)(i) - Hardcoded PHI credentials
                  164.312(e)(2)(ii) - Unencrypted PHI transmission
      SLA: 4 hours remaining
   
   ✅ GDPR: PASS (89.3%)
      Status: All data protection requirements met
   
   ⚠️ NIST CSF: PARTIAL (71.0%)
      Issues: PR.DS-1 - Data security controls need enhancement

💡 Immediate Actions Required:
   1. [CRITICAL] Fix hardcoded PHI credentials (4 hours)
   2. [HIGH] Implement TLS 1.3 for PHI transmission (24 hours)
   3. [MEDIUM] Enhance NIST data security controls (7 days)

🔒 Evidence Collected:
   Evidence ID: EVD_20240815_ABC123
   Integrity Hash: sha256:a1b2c3d4...
   Chain of Custody: 3 entries

name: Enhanced SAST Security & Compliance Scan
on: [push, pull_request]

jobs:
  security-compliance-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '18'
          
      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.9'
          
      - name: Install Dependencies
        run: |
          npm install
          pip install -r requirements.txt
          
      - name: Create Compliance Baseline (if not exists)
        run: |
          echo '{"project_path": "./src", "frameworks": ["owasp", "nist"]}' | \\
            node src/server.js compliance_drift_baseline || true
          
      - name: Enhanced Security Scan with Compliance
        run: |
          echo '{"dirpath": "./", "policies": ["owasp", "nist"]}' | \\
            node src/server.js enhanced_scan_directory
            
      - name: Collect Compliance Evidence
        run: |
          echo '{
            "scan_path": "./src",
            "frameworks": ["owasp", "nist"],
            "collector": "github-actions",
            "notes": "CI/CD pipeline compliance scan"
          }' | node src/server.js collect_compliance_evidence
          
      - name: Detect Compliance Drift
        run: |
          echo '{"project_path": "./src", "frameworks": ["owasp", "nist"]}' | \\
            node src/server.js compliance_drift_detect
            
      - name: Generate Enhanced SARIF Report
        run: |
          echo '{
            "scan_path": "./",
            "report_dir": "./reports",
            "format": "sarif",
            "include_compliance_matrix": true
          }' | node src/server.js generate_enhanced_report
          
      - name: Upload SARIF Results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: reports/enhanced-sast-report-*.sarif
          
      - name: Check Compliance Gate
        run: |
          # Fail build if critical compliance violations found
          if grep -q '"status": "FAIL"' reports/*.json; then
            echo "❌ Compliance gate failed - critical violations found"
            exit 1
          fi

# Enhanced Dockerfile with compliance features
FROM node:18-alpine

WORKDIR /app

# Install Python and security tools
RUN apk add --no-cache python3 py3-pip
COPY requirements.txt .
RUN pip install -r requirements.txt

# Install Node.js dependencies
COPY package*.json ./
RUN npm ci --only=production

# Copy application code
COPY src/ ./src/
COPY config/ ./config/
COPY infra/ ./infra/

# Create compliance directories
RUN mkdir -p compliance-baselines compliance-evidence incident-reports logs

# Compliance environment variables
ENV ENABLE_ENHANCED_COMPLIANCE=true
ENV ORGANIZATION_INDUSTRY=general
ENV DEFAULT_COMPLIANCE_FRAMEWORKS=owasp,nist_csf
ENV EVIDENCE_RETENTION_YEARS=7

# Expose health check port
EXPOSE 3000 3001

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \\
  CMD curl -f http://localhost:3001/health || exit 1

# Start with compliance initialization
CMD ["node", "src/server.js"]

version: '3.8'
services:
  spotter-sast:
    build: .
    ports:
      - "3000:3000"
      - "3001:3001"
    environment:
      - ORGANIZATION_INDUSTRY=healthcare
      - ENABLE_HIPAA=true
      - ENABLE_EVIDENCE_COLLECTION=true
    volumes:
      - ./code-to-scan:/scan-target:ro
      - ./compliance-reports:/app/reports
      - ./compliance-evidence:/app/compliance-evidence
      - ./compliance-baselines:/app/compliance-baselines
    depends_on:
      - postgres
      - redis

  postgres:
    image: postgres:15
    environment:
      POSTGRES_DB: compliance_db
      POSTGRES_USER: compliance_user
      POSTGRES_PASSWORD: secure_password
    volumes:
      - postgres_data:/var/lib/postgresql/data

  redis:
    image: redis:7-alpine
    volumes:
      - redis_data:/data

volumes:
  postgres_data:
  redis_data:

# .pre-commit-config.yaml
repos:
  - repo: local
    hooks:
      - id: spotter-sast-security
        name: Spotter-SAST Security Scan
        entry: node src/server.js enhanced_scan_file
        language: system
        files: \\.(js|ts|py|java|go|php|rb|rs)$
      
      - id: spotter-sast-compliance
        name: Spotter-SAST Compliance Check
        entry: ./infra/scripts/compliance.sh quick-scan
        language: system
        pass_filenames: false
        always_run: true

Critical → Immediate: Compliance Officer, CISO, CEO
        → 1 hour: Legal Team, Board Chair  
        → 4 hours: External Counsel

High    → 1 hour: Compliance Officer, Security Team
        → 4 hours: Department Heads
        → 24 hours: Executive Team

Medium  → 4 hours: Security Team
        → 24 hours: Compliance Officer  
        → Weekly: Management Team

# Healthcare Organizations
ORGANIZATION_INDUSTRY=healthcare
# Auto-enables: HIPAA + NIST CSF
# Features: PHI detection, HIPAA breach workflows, medical data patterns

# Financial Services  
ORGANIZATION_INDUSTRY=finance
# Auto-enables: PCI DSS + SOX + NIST CSF
# Features: Payment data protection, financial controls, audit trails

# E-commerce Platforms
ORGANIZATION_INDUSTRY=ecommerce  
# Auto-enables: PCI DSS + GDPR + CCPA
# Features: Customer data protection, payment security, privacy rights

# Government Agencies
ORGANIZATION_INDUSTRY=government
# Auto-enables: FISMA + FedRAMP + NIST CSF
# Features: Government security standards, federal compliance

# General/Enterprise
ORGANIZATION_INDUSTRY=general
# Auto-enables: OWASP + NIST CSF + ISO 27001
# Features: General security best practices, enterprise standards

# Organization Configuration
ORGANIZATION_NAME=Your Organization
ORGANIZATION_INDUSTRY=general
ORGANIZATION_SIZE=medium
CONTACT_EMAIL=compliance@yourorg.com

# Security Configuration
JWT_SECRET=your-256-bit-secret-key
ENABLE_RBAC=true
TOKEN_EXPIRY=24h
ENABLE_AUDIT_LOGGING=true

# Enhanced Compliance Features (v2.1.0)
ENABLE_ENHANCED_COMPLIANCE=true
ENABLE_COMPLIANCE_DRIFT_DETECTION=true
ENABLE_MULTI_TENANT_MANAGEMENT=true
ENABLE_EVIDENCE_COLLECTION=true
ENABLE_AUTOMATED_REMEDIATION=true
ENABLE_ADVANCED_ANALYTICS=true

# Framework Configuration
DEFAULT_COMPLIANCE_FRAMEWORKS=owasp,nist_csf
AUTO_ENABLE_INDUSTRY_FRAMEWORKS=true

# Individual framework controls
ENABLE_HIPAA=false
ENABLE_GDPR=false
ENABLE_PCI_DSS=false
ENABLE_ISO27001=false
ENABLE_SOX=false
ENABLE_NIST_CSF=true

# Monitoring Configuration
DEFAULT_SCAN_SCHEDULE=0 */6 * * *
COMPLIANCE_SCAN_FREQUENCY=daily
ALERT_THRESHOLD_CRITICAL=0
ALERT_THRESHOLD_HIGH=5

# Evidence & Audit Configuration
EVIDENCE_RETENTION_YEARS=7
EVIDENCE_CRYPTOGRAPHIC_SIGNING=true
COMPLIANCE_EVIDENCE_RETENTION_DAYS=2555
AUDIT_TRAIL_IMMUTABLE=true

{
  "tenant_id": "healthcare_division",
  "config": {
    "name": "Healthcare Division", 
    "industry": "healthcare",
    "riskTolerance": "zero",
    "enabledFrameworks": ["hipaa", "nist"],
    "customRules": ["phi_detection", "encryption_required"],
    "contactEmail": "compliance@healthcare-div.com",
    "complianceOfficer": "Dr. Sarah Johnson",
    "escalationMatrix": {
      "critical": ["ciso@company.com", "legal@company.com"],
      "high": ["security@company.com", "compliance@healthcare-div.com"]
    }
  }
}

{
  "healthcare_strict": {
    "name": "Healthcare Strict Security Policy",
    "requiredChecks": ["hardcoded_secrets", "weak_crypto", "phi_exposure"],
    "failThresholds": {
      "critical": 0,
      "high": 0,
      "medium": 2
    },
    "complianceFrameworks": ["hipaa", "nist"],
    "automatedRemediation": true,
    "evidenceCollection": true
  },
  "enterprise_standard": {
    "name": "Enterprise Standard Policy",
    "requiredChecks": ["owasp_top_10"],
    "failThresholds": {
      "critical": 0,
      "high": 5,
      "medium": 20
    }
  }
}

{
  "hipaa": {
    "version": "2013_final_rule",
    "enabled": true,
    "riskTolerance": "zero",
    "requiredControls": ["164.312(a)", "164.312(c)", "164.312(e)"],
    "patterns": {
      "phi_patterns": [
        "(?i)(ssn|social\\\\s*security)\\\\s*[:=]?\\\\s*\\\\d{3}-?\\\\d{2}-?\\\\d{4}",
        "(?i)(patient|medical)\\\\s*id\\\\s*[:=]?\\\\s*\\\\d+"
      ]
    },
    "slaHours": 4,
    "automatedWorkflows": ["phi_exposure", "audit_trail"]
  }
}

# Performance Tuning
MAX_CONCURRENT_COMPLIANCE_SCANS=3
COMPLIANCE_SCAN_TIMEOUT=1800
CACHE_COMPLIANCE_RESULTS=true
COMPLIANCE_CACHE_EXPIRATION=60
SCAN_PARALLEL_WORKERS=4
EVIDENCE_BATCH_SIZE=100
ANALYTICS_QUERY_TIMEOUT_SECONDS=30

# Scalability Settings
MAX_TENANTS_PER_INSTANCE=100
BASELINE_COMPARISON_CACHE_SIZE=1000
ANALYTICS_HISTORICAL_RETENTION_MONTHS=24
EVIDENCE_RETENTION_YEARS=7

# Setup & Configuration
./infra/scripts/compliance.sh setup                    # Initialize compliance system
./infra/scripts/compliance.sh configure-industry healthcare  # Configure for industry
./infra/scripts/compliance.sh enable hipaa            # Enable specific framework
./infra/scripts/compliance.sh list                    # List available frameworks

# Scanning & Analysis  
./infra/scripts/compliance.sh quick-scan ./src        # Quick compliance scan
./infra/scripts/compliance.sh scan ./project hipaa,gdpr html  # Full scan with frameworks
./infra/scripts/compliance.sh baseline ./src hipaa   # Create compliance baseline

# Monitoring & Reporting
./infra/scripts/compliance.sh start-monitoring ./src "0 */6 * * *"  # Start monitoring
./infra/scripts/compliance.sh report ./project html   # Generate comprehensive report
./infra/scripts/compliance.sh status                  # Check system status
./infra/scripts/compliance.sh validate               # Validate configuration

# Database Configuration
USE_DATABASE_STORAGE=true
DATABASE_TYPE=postgresql
DATABASE_HOST=your-db-host
DATABASE_PORT=5432
DATABASE_NAME=compliance_db
DATABASE_USER=compliance_user
DATABASE_PASS=your-secure-password
DATABASE_SSL=true
DATABASE_CONNECTION_POOL_SIZE=10

# Redis Caching
REDIS_ENABLED=true
REDIS_HOST=your-redis-host
REDIS_PORT=6379
REDIS_PASSWORD=your-redis-password
REDIS_CACHE_TTL_SECONDS=3600

// In config/custom-compliance-rules.json
{
  "custom_patterns": {
    "company_api_leak": {
      "patterns": ["(?i)ACME-API-KEY-[A-Za-z0-9]{32}"],
      "severity": "Critical",
      "owaspCategory": "A02_Cryptographic_Failures",
      "description": "Company API key detected in code",
      "complianceMapping": {
        "hipaa": ["164.312(a)(2)(i)"],
        "pci_dss": ["3.4"]
      }
    },
    "internal_service_creds": {
      "patterns": ["(?i)(internal[_-]?service)[_-]?(key|token|secret)\\\\s*[:=]\\\\s*[\"'][^\"'\\\\s]{10,}"],
      "severity": "High",
      "description": "Internal service credentials detected"
    }
  }
}

# Configure Slack webhook in .env
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK
NOTIFICATION_CHANNELS=email,slack
IMMEDIATE_NOTIFY_SEVERITIES=critical,high

# Configure Teams webhook in .env
TEAMS_WEBHOOK_URL=https://outlook.office.com/webhook/YOUR/TEAMS/WEBHOOK
WEBHOOK_RETRY_ATTEMPTS=3
WEBHOOK_TIMEOUT_SECONDS=30

# For repositories with 100,000+ files
SCAN_PARALLEL_WORKERS=8
MAX_CONCURRENT_COMPLIANCE_SCANS=5
COMPLIANCE_SCAN_TIMEOUT=3600
EVIDENCE_BATCH_SIZE=500

# Memory optimization
NODE_OPTIONS=--max-old-space-size=8192

# Caching optimization
CACHE_COMPLIANCE_RESULTS=true
COMPLIANCE_CACHE_EXPIRATION=120
BASELINE_COMPARISON_CACHE_SIZE=5000

# Single file scan with compliance frameworks
echo '{"filepath": "/path/to/file.js", "policies": ["hipaa", "gdpr"]}' | \\
  node src/server.js enhanced_scan_file

# Directory scan with compliance evidence collection
echo '{"dirpath": "/path/to/project", "enableMonitoring": true}' | \\
  node src/server.js enhanced_scan_directory

# Generate compliance report
echo '{"scan_path": "/path/to/project", "report_dir": "./reports", "format": "html"}' | \\
  node src/server.js generate_enhanced_report

import { McpClient } from "@modelcontextprotocol/sdk/client/mcp.js";

const client = new McpClient();
await client.connect();

// Enhanced scan with compliance
const result = await client.callTool("enhanced_scan_file", {
  filepath: "/path/to/file.js",
  policies: ["hipaa", "gdpr"],
  includeFixSuggestions: true
});

// Multi-tenant compliance assessment
const assessment = await client.callTool("tenant_compliance_assessment", {
  tenant_id: "healthcare_division",
  project_path: "./patient-portal"
});

// Collect compliance evidence
const evidence = await client.callTool("collect_compliance_evidence", {
  scan_path: "./src",
  frameworks: ["hipaa", "gdpr"],
  collector: "security@company.com",
  notes: "Quarterly audit scan"
});

# Debug mode with compliance details
export LOG_LEVEL=debug
export DEBUG_COMPLIANCE_ENGINE=true
export COMPLIANCE_DEBUG_MODE=true
npm start

# Monitor compliance logs
tail -f src/compliance/logs/compliance.log

# Check system health
curl http://localhost:3001/health

# Validate compliance components
./infra/scripts/compliance.sh status

# Test compliance frameworks
echo '{"action": "list"}' | node src/server.js compliance_frameworks_manage

# Monitor resource usage during scans
top -p $(pgrep -f "node src/server.js")

# Check compliance scan performance
time echo '{"dirpath": "./src"}' | node src/server.js enhanced_scan_directory

# Analyze evidence collection performance
time echo '{
  "scan_path": "./src",
  "frameworks": ["owasp"],
  "collector": "test@example.com"
}' | node src/server.js collect_compliance_evidence

# Clone repository
git clone https://github.com/george-mellow/spotter-sast.git
cd spotter-sast

# Install dependencies
npm install
pip install -r requirements.txt

# Run in development mode
LOG_LEVEL=debug npm start

# Run security scan on test files
npm test

# Run compliance-specific tests
node test/test-compliance.js

# Test individual compliance features
./infra/scripts/compliance.sh validate