Security & Compliance

pip install boto3

pip install hvac

# .env
DATABASE_URL=postgresql://user:pass@localhost:5432/mydb
STRIPE_SECRET_KEY=sk_test_...
SENDGRID_API_KEY=SG...

pip install pyjwt flask

from enum import Enum
from functools import wraps
from flask import jsonify

class Role(Enum):
    ADMIN = "admin"
    USER = "user"
    VIEWER = "viewer"

class Permission(Enum):
    READ = "read"
    WRITE = "write"
    DELETE = "delete"
    ADMIN = "admin"

# Define role permissions
ROLE_PERMISSIONS = {
    Role.ADMIN: [Permission.READ, Permission.WRITE, Permission.DELETE, Permission.ADMIN],
    Role.USER: [Permission.READ, Permission.WRITE],
    Role.VIEWER: [Permission.READ]
}

def require_permission(permission):
    """Decorator to check user has required permission"""
    def decorator(f):
        @wraps(f)
        def decorated_function(current_user, *args, **kwargs):
            # Get user role from database/token
            user_role = get_user_role(current_user)

            # Check permission
            if permission not in ROLE_PERMISSIONS.get(user_role, []):
                return jsonify({'message': 'Insufficient permissions'}), 403

            return f(current_user, *args, **kwargs)
        return decorated_function
    return decorator

@app.route('/users/<user_id>', methods=['DELETE'])
@token_required
@require_permission(Permission.DELETE)
def delete_user(current_user, user_id):
    """Only admins can delete users"""
    # Delete user logic
    return jsonify({'message': f'User {user_id} deleted'})

@app.route('/reports', methods=['GET'])
@token_required
@require_permission(Permission.READ)
def view_reports(current_user):
    """All authenticated users can view reports"""
    return jsonify({'reports': []})

import sqlite3

def get_user_vulnerable(email):
    conn = sqlite3.connect('users.db')
    cursor = conn.cursor()

    # NEVER DO THIS - allows SQL injection!
    query = f"SELECT * FROM users WHERE email = '{email}'"
    cursor.execute(query)

    return cursor.fetchone()

# Attacker input: ' OR '1'='1
# Query becomes: SELECT * FROM users WHERE email = '' OR '1'='1'
# Returns ALL users!

from flask import Flask, render_template, request
from markupsafe import escape

app = Flask(__name__)

@app.route('/search')
def search():
    query = request.args.get('q', '')

    # Jinja2 auto-escapes by default
    return render_template('search.html', query=query)

# template: search.html
# {{ query }} - automatically escaped
# Attacker input: <script>alert('XSS')</script>
# Rendered as: &lt;script&gt;alert('XSS')&lt;/script&gt;
# Browser shows the text, doesn't execute

# If you need to allow some HTML (dangerous!)
from bleach import clean

def sanitize_html(html):
    """Allow only safe HTML tags"""
    return clean(
        html,
        tags=['p', 'br', 'strong', 'em', 'a'],
        attributes={'a': ['href']},
        strip=True
    )

from flask import Flask, request, jsonify
from pydantic import BaseModel, EmailStr, field_validator
from typing import Optional

app = Flask(__name__)

class UserCreate(BaseModel):
    email: EmailStr  # Validates email format
    username: str
    age: Optional[int] = None

    @field_validator('username')
    @classmethod
    def username_alphanumeric(cls, v):
        if not v.isalnum():
            raise ValueError('Username must be alphanumeric')
        if len(v) < 3 or len(v) > 20:
            raise ValueError('Username must be 3-20 characters')
        return v

    @field_validator('age')
    @classmethod
    def age_range(cls, v):
        if v is not None and (v < 13 or v > 120):
            raise ValueError('Age must be between 13 and 120')
        return v

@app.route('/users', methods=['POST'])
def create_user():
    try:
        # Validate input
        user_data = UserCreate(**request.json)

        # Use validated data
        create_user_in_db(user_data)

        return jsonify({'message': 'User created'}), 201
    except ValueError as e:
        return jsonify({'error': str(e)}), 400

# 1. Keep system updated
sudo apt update && sudo apt upgrade -y

# 2. Disable unused services
sudo systemctl disable bluetooth
sudo systemctl disable cups  # Printer service

# 3. Configure firewall (UFW)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp   # SSH
sudo ufw allow 80/tcp   # HTTP
sudo ufw allow 443/tcp  # HTTPS
sudo ufw enable

# 4. Secure SSH
# Edit /etc/ssh/sshd_config:
PermitRootLogin no
PasswordAuthentication no  # Use keys only
Port 2222  # Change default port (optional)
MaxAuthTries 3

# 5. Fail2ban (block brute-force attacks)
sudo apt install fail2ban
sudo systemctl enable fail2ban

# 6. Disable unused network protocols
sudo sysctl -w net.ipv4.conf.all.send_redirects=0
sudo sysctl -w net.ipv4.conf.all.accept_redirects=0

# 7. Set file permissions
chmod 600 /home/user/.ssh/authorized_keys
chmod 700 /home/user/.ssh

# 8. Remove unnecessary packages
sudo apt autoremove

# Use specific version tags, not 'latest'
FROM python:3.11.6-slim

# Create non-root user
RUN useradd -m -u 1000 appuser

# Set working directory
WORKDIR /app

# Copy dependencies first (layer caching)
COPY requirements.txt .

# Install dependencies
RUN pip install --no-cache-dir -r requirements.txt

# Copy application code
COPY . .

# Change ownership to non-root user
RUN chown -R appuser:appuser /app

# Switch to non-root user
USER appuser

# Run as non-root
CMD ["python", "app.py"]

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault

  containers:
  - name: app
    image: myapp:1.0.0

    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      capabilities:
        drop:
          - ALL

    resources:
      limits:
        memory: "512Mi"
        cpu: "500m"
      requests:
        memory: "256Mi"
        cpu: "250m"

    volumeMounts:
    - name: tmp
      mountPath: /tmp

  volumes:
  - name: tmp
    emptyDir: {}

from flask import Flask, request, jsonify, send_file
import json
from datetime import datetime, timezone

app = Flask(__name__)

@app.route('/user/<user_id>/data', methods=['GET'])
def export_user_data(user_id):
    """Right to data portability - export all user data"""

    # Gather all user data from databases
    user_data = {
        'user_info': get_user_info(user_id),
        'orders': get_user_orders(user_id),
        'preferences': get_user_preferences(user_id),
        'activity_log': get_user_activity(user_id),
        'exported_at': datetime.now(timezone.utc).isoformat()
    }

    # Create JSON file
    filename = f"user_data_{user_id}.json"
    with open(filename, 'w') as f:
        json.dump(user_data, f, indent=2)

    # Return file for download
    return send_file(filename, as_attachment=True)

@app.route('/user/<user_id>', methods=['DELETE'])
def delete_user_data(user_id):
    """Right to erasure - delete all user data"""

    # Verify user consent/request
    if not verify_deletion_request(user_id):
        return jsonify({'error': 'Invalid deletion request'}), 403

    # Delete from all systems
    delete_user_from_database(user_id)
    delete_user_from_analytics(user_id)
    delete_user_from_email_list(user_id)

    # Anonymize logs (can't delete for compliance)
    anonymize_user_logs(user_id)

    # Log deletion (audit trail)
    log_gdpr_deletion(user_id, datetime.now(timezone.utc))

    return jsonify({'message': 'User data deleted'}), 200

@app.route('/user/<user_id>/consent', methods=['POST'])
def update_consent(user_id):
    """Record user consent for data processing"""

    consent_data = {
        'user_id': user_id,
        'marketing_emails': request.json.get('marketing_emails', False),
        'analytics': request.json.get('analytics', False),
        'third_party_sharing': request.json.get('third_party_sharing', False),
        'timestamp': datetime.now(timezone.utc).isoformat(),
        'ip_address': request.remote_addr
    }

    # Store consent record
    save_consent_record(consent_data)

    return jsonify({'message': 'Consent updated'}), 200

# Install
pip install bandit

# Scan project
bandit -r . -f json -o bandit-report.json

# Common issues Bandit finds:
# - Hardcoded passwords
# - SQL injection vulnerabilities
# - Use of insecure random (random vs secrets)
# - Insecure deserialization (pickle)
# - Shell injection vulnerabilities

name: Security Scan

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      # SAST - Python code scanning
      - name: Bandit Security Scan
        run: |
          pip install bandit
          bandit -r . -f json -o bandit-report.json

      # SCA - Dependency vulnerabilities
      - name: Safety Check
        run: |
          pip install safety
          safety check --json > safety-report.json

      # Secret scanning
      - name: TruffleHog Secret Scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./

      # Container scanning
      - name: Build Docker image
        run: docker build -t myapp:$GITHUB_SHA .

      - name: Trivy Container Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:$GITHUB_SHA
          severity: 'CRITICAL,HIGH'
          exit-code: '1'  # Fail if vulnerabilities found

      # IaC scanning (Trivy config scan - successor to tfsec)
      - name: Terraform Security Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'config'
          scan-ref: '.'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'