# Security Configuration for mypylogger
# Zero-tolerance security policy configuration

zero_tolerance_policy:
  enabled: true
  block_pr_merge: true
  fail_on_severity:
    - critical
    - high
    - medium
    - low
  required_scans:
    - dependency_vulnerabilities
    - code_security_analysis
    - secret_detection
    - supply_chain_security

dependency_security:
  tools:
    pip_audit:
      enabled: true
      fail_on_any_vulnerability: true
      scan_requirements: true
      scan_installed_packages: true
      output_format: json
      
    safety:
      enabled: true
      fail_on_any_vulnerability: true
      check_full_report: true
      ignore_unpinned: false
      output_format: json

code_security:
  codeql:
    enabled: true
    fail_on_error: true
    languages:
      - python
    queries:
      - security-and-quality
      - security-extended
    upload_sarif: true
    
  bandit:
    enabled: true
    fail_on_any_issue: true
    confidence_level: low
    severity_level: low
    scan_paths:
      - src/
    exclude_paths:
      - tests/
    output_format: json

secret_detection:
  trufflehog:
    enabled: true
    fail_on_any_secret: true
    scan_entire_history: false
    scan_filesystem: true
    output_format: json
    
  patterns:
    enabled: true
    custom_patterns:
      - api_keys
      - passwords
      - tokens
      - certificates

supply_chain_security:
  dependency_verification:
    enabled: true
    verify_signatures: true
    check_checksums: true
    
  license_compliance:
    enabled: true
    allowed_licenses:
      - MIT
      - Apache-2.0
      - BSD-3-Clause
      - BSD-2-Clause
    blocked_licenses:
      - GPL-3.0
      - AGPL-3.0

security_reporting:
  formats:
    - json
    - sarif
    - table
    
  upload_locations:
    - github_security_tab
    - workflow_artifacts
    
  notifications:
    enabled: true
    critical_high:
      block_workflow: true
      notify_maintainers: true
      create_issue: true
      
    medium_low:
      block_workflow: true  # Zero-tolerance: even low severity blocks
      notify_maintainers: true
      create_issue: true

emergency_response:
  critical_response:
    max_response_time_hours: 4
    max_resolution_time_hours: 24
    escalation_enabled: true
    
  high_response:
    max_response_time_hours: 8
    max_resolution_time_hours: 48
    escalation_enabled: true
    
  procedures:
    immediate_block: true
    create_security_issue: true
    notify_maintainers: true
    document_incident: true
    escalate_critical: true

compliance:
  standards:
    - owasp_top_10
    - cwe_top_25
    - nist_cybersecurity_framework
    
  audit_trail:
    enabled: true
    retention_days: 365
    include_scan_results: true
    include_resolution_actions: true
    
  metrics:
    enabled: true
    track_resolution_time: true
    track_detection_accuracy: true
    track_false_positive_rate: true
    generate_monthly_reports: true

workflow_integration:
  required_checks:
    - dependency_scan_pass
    - code_analysis_pass
    - secret_scan_pass
    - supply_chain_pass
    
  blocking_behavior:
    block_on_any_failure: true
    allow_manual_override: false
    require_security_review: true
    
  automation:
    auto_create_issues: true
    auto_assign_security_team: true
    auto_label_severity: true
    auto_notify_stakeholders: true