Code Analysis and AI Pentest

<h2 id="bkmrk-code-analysis-and-ai">Code Analysis and AI Pentest — SecuScan v0.28.0</h2>

<h3 id="bkmrk-codeworker-%E2%80%94-code-se">Codeworker — Code Security Scanner</h3> <p id="bkmrk-the-codeworker-is-a-">The Codeworker is a dedicated Go service for source code security analysis. It contains 103 functions across 8 analysis phases, executed sequentially after Git repository cloning.</p>

<h4 id="bkmrk-the-8-analysis-phase">The 8 Analysis Phases</h4> <table id="bkmrk-phasenametoolsdescri"> <thead><tr><th>Phase</th><th>Name</th><th>Tools</th><th>Description</th></tr></thead> <tbody> <tr><td>1</td><td><strong>Secret Detection</strong></td><td>Gitleaks</td><td>Detection of API keys, passwords, tokens, certificates in code and Git history</td></tr> <tr><td>2</td><td><strong>SAST (Static Analysis)</strong></td><td>Gosec, Semgrep, Bandit, ESLint-Security</td><td>Multi-language static analysis: Go, Python, JavaScript/TypeScript, Java. Known vulnerability detection (CWE)</td></tr> <tr><td>3</td><td><strong>Dependency Analysis</strong></td><td>npm audit, go vuln, pip audit, safety</td><td>Vulnerable dependency detection (CVE), problematic licenses, outdated versions</td></tr> <tr><td>4</td><td><strong>Code Quality</strong></td><td>Internal analyzers</td><td>Cyclomatic complexity, code duplication, test coverage, naming conventions</td></tr> <tr><td>5</td><td><strong>License Compliance</strong></td><td>Internal analyzers</td><td>Incompatible license detection (GPL in MIT code, etc.), missing licenses</td></tr> <tr><td>6</td><td><strong>Container Security</strong></td><td>Trivy, Hadolint</td><td>Dockerfile and image analysis: base image vulnerabilities, best practices, non-root, multi-stage</td></tr> <tr><td>7</td><td><strong>IaC Security</strong></td><td>tfsec, Checkov</td><td>Infrastructure as Code analysis: Terraform, CloudFormation, Kubernetes manifests, Helm charts</td></tr> <tr><td>8</td><td><strong>AI-Augmented Analysis</strong></td><td>Claude AI (Anthropic)</td><td>AI-powered contextual analysis of findings: real/false positive classification, prioritization, remediation recommendations</td></tr> </tbody> </table>

<h4 id="bkmrk-automatic-version-de">Automatic Version Detection (v0.28.0)</h4> <p id="bkmrk-after-cloning-the-gi">After cloning the Git repository, the codeworker automatically detects the application version:</p> <ul id="bkmrk-version_tag%3A-git-des"> <li><strong>version_tag</strong>: <code>git describe --tags --always</code> (e.g., <code>v0.27.12-3-gabcdef</code>)</li> <li><strong>app_version</strong>: Parses VERSION.md (pattern <code>X.Y.Z</code>) or package.json (<code>version</code> field)</li> <li>Both values are stored in the <code>code_scans</code> table and displayed in the frontend</li> </ul>

<h3 id="bkmrk-false-positive-suppr">False Positive Suppression System (v0.28.0)</h3> <p id="bkmrk-secuscan-v0.28.0-int">SecuScan v0.28.0 introduces a false positive management system based on SHA256 fingerprints for cross-scan persistence.</p>

<h4 id="bkmrk-how-it-works">How It Works</h4> <ul id="bkmrk-fingerprint%3A-sha256%28"> <li><strong>Fingerprint</strong>: <code>SHA256(repository_id|tool|rule_id|category|title|file_path)</code></li> <li>Allows identifying the same issue across scans, even if line numbers change</li> <li>Three statuses: <code>false_positive</code>, <code>accepted_risk</code>, <code>wont_fix</code></li> <li><strong>Auto-application</strong>: existing suppressions are automatically applied during new scans</li> </ul>

<h4 id="bkmrk-ai-report-integratio">AI Report Integration</h4> <ul id="bkmrk-issues-already-marke"> <li>Issues already marked (accepted_risk, false_positive) are separated in the Claude AI prompt</li> <li>The AI report receives two sections: new issues to address and previously accepted issues</li> <li>The prompt instructs the AI not to re-flag already accepted issues</li> </ul>

<h4 id="bkmrk-api-endpoints">API Endpoints</h4> <table id="bkmrk-endpointdescription-"> <thead><tr><th>Endpoint</th><th>Description</th></tr></thead> <tbody> <tr><td><code>POST /code-scans/issues/{id}/suppress</code></td><td>Suppress/accept an issue (creates a fingerprint)</td></tr> <tr><td><code>DELETE /code-scans/suppressions/{id}</code></td><td>Remove a suppression</td></tr> <tr><td><code>GET /code-scans/repositories/{id}/suppressions</code></td><td>List repository suppressions</td></tr> <tr><td><code>POST /code-scans/{id}/apply-suppressions</code></td><td>Apply suppressions to scan issues</td></tr> </tbody> </table>

<h3 id="bkmrk-ai-remediation-repor">AI Remediation Report</h3> <p id="bkmrk-secuscan-generates-a">SecuScan generates AI-powered remediation reports using Claude AI:</p> <ul id="bkmrk-trigger%3A-%22analyze-wi"> <li><strong>Trigger</strong>: "Analyze with AI" button on code scan detail page</li> <li><strong>Processing</strong>: Asynchronous with database persistence (v0.27.1+)</li> <li><strong>Content</strong>: Issue classification, prioritization, detailed recommendations, corrected code examples</li> <li><strong>Format</strong>: Markdown with .md file download</li> <li><strong>Structured prompt</strong>: Scan context (language, version, tools) + top 50 issues by severity + accepted issues (v0.28.0)</li> </ul>

<h3 id="bkmrk-ai-pentest-%E2%80%94-penetra">AI Pentest — Penetration Testing Agent</h3> <p id="bkmrk-ai-assisted-penetrat">AI-assisted penetration testing module composed of two services:</p>

<h4 id="bkmrk-pentest-agent-%28claud">Pentest Agent (Claude AI)</h4> <ul id="bkmrk-model%3A-claude-ai-%28an"> <li><strong>Model</strong>: Claude AI (Anthropic)</li> <li><strong>Phases</strong>: Reconnaissance, enumeration, vulnerability assessment, exploitation, reporting</li> <li><strong>Authorization management</strong>: Legal verification before each test (Law 25 compliance)</li> <li><strong>Persistence</strong>: Findings with exploitation evidence stored in database</li> </ul>

<h4 id="bkmrk-pentest-worker-%28temp">Pentest Worker (Temporal)</h4> <ul id="bkmrk-orchestration%3A-tempo"> <li><strong>Orchestration</strong>: Temporal Server for long-running workflow management</li> <li><strong>Reliability</strong>: Automatic retry, compensation, timeout management</li> <li><strong>Observability</strong>: Temporal UI for in-progress workflow monitoring</li> </ul>

<h4 id="bkmrk-pentest-workflow">Pentest Workflow</h4> <ol id="bkmrk-user-creates-a-legal"> <li>User creates a legal authorization via the interface</li> <li>Pentest launch with target and scope selection</li> <li>Pentest Worker creates a Temporal workflow</li> <li>Pentest Agent executes phases sequentially via Claude AI</li> <li>Each finding is persisted with evidence</li> <li>A final report is automatically generated</li> </ol>

<h3 id="bkmrk-network-finding-ai-a">Network Finding AI Analysis</h3> <p id="bkmrk-in-addition-to-code%2C">In addition to code, Claude AI analyzes network findings:</p> <ul id="bkmrk-automatic-classifica"> <li><strong>Automatic classification</strong>: Real, false positive, accepted risk</li> <li><strong>Batch processing</strong>: Up to 500 findings per batch (v0.23.0+)</li> <li><strong>Auto-application</strong>: Classifications are automatically applied to findings</li> <li><strong>History</strong>: All AI analyses are preserved with timestamps</li> </ul>