# Security Module Configuration for Python Libraries
# Example: pip packages, open source libraries, SDK projects

scanners:
  pip-audit:
    enabled: true
    output_file: "security/reports/latest/pip-audit.json"
    format: "json"
    # Libraries typically have minimal dependencies
    include_dev: false
    # Focus on production dependencies only
    production_only: true
    
  bandit:
    enabled: true
    output_file: "security/reports/latest/bandit.json"
    format: "json"
    # Library-specific exclusions
    exclude_paths: 
      - "tests/"
      - "docs/"
      - "examples/"
      - "benchmarks/"
      - "build/"
      - "dist/"
    # Higher confidence for libraries (less false positives)
    confidence_level: "high"
    severity_level: "medium"
    
  secrets:
    enabled: false  # Libraries shouldn't contain secrets
    # Enable only if library handles authentication/keys
    
  safety:
    enabled: true
    output_file: "security/reports/latest/safety.json"
    format: "json"
    # Check for known vulnerable dependencies

# Library-specific archival settings
archival:
  enabled: true
  retention_days: 365  # Longer retention for library releases
  archive_path: "security/reports/archived"
  # Archive on releases and monthly
  archive_frequency: "release"

# Document generation for libraries
document:
  template: "security/config/findings-template.md"
  output: "security/findings/SECURITY_FINDINGS.md"
  include_resolved: true  # Show resolved issues for transparency
  max_age_days: 180  # Longer history for libraries
  # Library-specific sections
  sections:
    - "dependency_vulnerabilities"
    - "code_security_issues"
    - "api_security_concerns"

# Library-specific remediation defaults
remediation_defaults:
  new_finding:
    status: "new"
    planned_action: "Library security assessment required"
    target_date: null
    assigned_to: "maintainer-team"
    notes: "Library security finding - impact on downstream users"
    workaround: "None - library fix required"
    priority: "high"  # Libraries affect many users
    business_impact: "Affects all library users"

# Faster response times for libraries (public impact)
priority_escalation:
  critical: 
    sla_hours: 2  # Very fast for critical library issues
    escalation_team: "maintainer-team"
    public_disclosure: true
  high:
    sla_hours: 12
    escalation_team: "maintainer-team"
    public_disclosure: true
  medium:
    sla_days: 3  # Faster than web apps
    escalation_team: "maintainer-team"

# Library-specific assignment rules
assignment_rules:
  # All issues go to maintainers for libraries
  dependency_vulnerability: "maintainer-team"
  code_security_issue: "maintainer-team"
  api_security_concern: "maintainer-team"
  
# Release coordination
release_coordination:
  # Coordinate security fixes with releases
  security_release_process: true
  pre_release_security_check: true
  changelog_security_notes: true