# Security Module Configuration for Python Web Applications
# Example: Django, Flask, FastAPI projects

scanners:
  pip-audit:
    enabled: true
    output_file: "security/reports/latest/pip-audit.json"
    format: "json"
    # Include dev dependencies for comprehensive scanning
    include_dev: true
    
  bandit:
    enabled: true
    output_file: "security/reports/latest/bandit.json"
    format: "json"
    # Exclude common web app directories that generate noise
    exclude_paths: 
      - "tests/"
      - "migrations/"
      - "static/"
      - "media/"
      - "venv/"
      - ".venv/"
    # Focus on security-relevant issues
    confidence_level: "medium"
    severity_level: "medium"
    
  secrets:
    enabled: true
    output_file: "security/reports/latest/secrets-scan.json"
    format: "json"
    # Common web app secret patterns
    patterns:
      - "django_secret_key"
      - "database_url"
      - "api_key"
      - "jwt_secret"

# Web application specific archival settings
archival:
  enabled: true
  retention_days: 180  # 6 months for compliance
  archive_path: "security/reports/archived"
  # Archive more frequently for active development
  archive_frequency: "weekly"

# Document generation for web apps
document:
  template: "security/config/findings-template.md"
  output: "security/findings/SECURITY_FINDINGS.md"
  include_resolved: false
  max_age_days: 60  # Shorter for active development
  # Include web-specific sections
  sections:
    - "dependency_vulnerabilities"
    - "code_security_issues"
    - "secret_exposures"
    - "web_security_headers"

# Web app specific remediation defaults
remediation_defaults:
  new_finding:
    status: "new"
    planned_action: "Under security review"
    target_date: null
    assigned_to: "security-team"
    notes: "Web application security finding - requires assessment"
    workaround: "None identified"
    priority: "medium"
    business_impact: "Potential web application vulnerability"

# Priority escalation for web apps
priority_escalation:
  # Web apps need faster response for critical issues
  critical: 
    sla_hours: 4
    escalation_team: "security-incident-response"
  high:
    sla_hours: 24
    escalation_team: "security-team"
  medium:
    sla_days: 7
    escalation_team: "dev-team"

# Web application specific assignment rules
assignment_rules:
  # Route different types of findings to appropriate teams
  dependency_vulnerability: "dev-team"
  code_security_issue: "security-team"
  secret_exposure: "security-incident-response"
  configuration_issue: "devops-team"