Security testing

Français : ../testing.md

Control Plane tests

cd services/control-plane
pytest -q tests/test_security_*.py tests/test_platform_security_manifests.py

File	Covers
test_security_api.py	Posture API and security settings
test_security_auth.py	JWT (alg none, HS/RS confusion, kid, claims), API keys
test_security_commands.py	safe_exec: command injection, ffmpeg, garak
test_security_config.py	Secure defaults and list parsing
test_security_egress.py	Egress guard: SSRF, DNS rebinding, redirects, metadata
test_security_egress_wiring.py	Egress guard wired into tools, MCP, OAuth
test_security_events.py	Security events in the audit chain
test_security_http.py	Headers, body limits, hosts, proxies, rate limiting, startup guard
test_security_inputs.py	Templates, YAML, path traversal, IDOR, mass assignment, CSV
test_security_prompt_injection.py	Direct and indirect injection, output, canary
test_security_sql_inputs.py, test_security_sql_static.py	SQL injection (payloads and static checker)
test_security_tenant_settings.py	Tenant settings validation
test_security_attack_suite.py	Attack suite over every API operation: authentication, roles, injection fuzz, IDOR, mass assignment, WebSocket, webhooks
test_platform_security_manifests.py	Helm, Cilium, Kyverno, PostgreSQL manifests

Scanners (commands from .gitlab-ci.yml)

Tool	Local command	GitLab job	Forgejo job
bandit	bandit -r services/control-plane/src sdks/python/src --severity-level high --confidence-level medium	bandit	security-sast
semgrep	semgrep scan --config p/owasp-top-ten --config p/python --config p/typescript --severity ERROR --error	semgrep	security-semgrep
pip-audit	pip-audit --strict <project>	pip-audit	security-deps-python
npm audit	npm audit --audit-level=high --omit=dev	npm-audit	security-deps-node
gitleaks	gitleaks git --redact --exit-code 1 . then gitleaks dir --redact --exit-code 1 .	gitleaks	security-secrets
Trivy	trivy fs ., trivy config deploy, trivy image <image>	trivy-fs, trivy-config, trivy-image	security-fs
OWASP ZAP baseline	zap-baseline.py -t <target> (image ghcr.io/zaproxy/zaproxy)	zap-baseline	security-dast
kyverno	kyverno test deploy/policies/kyverno/tests	manifests	security-manifests
opa	opa test deploy/policies/opa -v	opa	policies
garak	python -m garak --model_type rest --generator_option_file deploy/ci/garak-rest.json --probes promptinject,dan,leakreplay	garak	ai-redteam
promptfoo	npx --yes promptfoo@latest eval -c deploy/ci/promptfoo.yaml	promptfoo	ai-redteam

Thresholds and blocking policy are described in ci-security-gates.