Add security review workflow for pull requests

.github/workflows/claudecodescanner.yaml

@@ -0,0 +1,178 @@
+name: Security NCLC Review
+
+permissions:
+  pull-requests: write  # Needed for leaving PR comments
+  contents: read
+
+on:
+  pull_request:
+  push:
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    env:
+      SLACK_WEBHOOK_URL: ${{ secrets.SAST_SECURITY_SLACK_WEBHOOK }}
+      SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+      PR_URL: ${{ github.event.pull_request.html_url }}
+      PR_CREATOR: ${{ github.event.pull_request.user.login }}
+      PR_HEAD_COMMIT_URL: ${{ github.event.pull_request.html_url }}/commits/${{ github.event.pull_request.head.sha }}
+      WORKFLOW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      GITHUB_SENDER: ${{ github.event.sender.login }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 2
+
+      - name: Generate Custom Instruction File
+        run: |
+          cat <<EOF > custom_instruction.md
+          You are a Principal Application Security Engineer performing a security-focused code review. Analyze all changes in this PR for security vulnerabilities and provide actionable feedback.
+          ## Review Scope & Priority
+          ### CRITICAL - Block PR if found:
+          - Hardcoded secrets, API keys, passwords, tokens
+          - SQL injection vulnerabilities
+          - Remote Code Execution (RCE) risks
+          - Path traversal vulnerabilities
+          - Unsafe deserialization
+          - Missing authentication/authorization on sensitive endpoints
+          - Exposed sensitive data in logs/responses
+          ### HIGH - Require immediate fix:
+          - Cross-Site Scripting (XSS) vulnerabilities
+          - Server-Side Request Forgery (SSRF)
+          - Insecure Direct Object References (IDOR)
+          - Cross-Site Request Forgery (CSRF) missing protections
+          - XML External Entity (XXE) injection
+          - Weak cryptography or hashing algorithms
+          - Race conditions in security controls
+          ### MEDIUM - Fix before production:
+          - Missing input validation/sanitization
+          - Overly permissive CORS policies
+          - Missing security headers
+          - Insufficient logging for security events
+          - Missing rate limiting
+          - Dependency vulnerabilities (outdated packages)
+          ## Technology-Specific Checks
+          ### Python Backend:
+          ```python
+          # Check for:
+          - f-strings or .format() with user input → SQL injection
+          - eval(), exec(), __import__() usage
+          - pickle/yaml.load without safe loading
+          - subprocess with shell=True
+          - Flask/Django debug mode enabled
+          - Missing @login_required decorators
+          - Weak password hashing (not using bcrypt/scrypt/argon2)
+          - os.path.join() without validation
+          - requests without timeout/verify SSL
+          - JWT without proper validation
+          ```
+          ### JavaScript/TypeScript Frontend:
+          ```javascript
+          // Check for:
+          - innerHTML/dangerouslySetInnerHTML with user input
+          - eval() or Function() constructor usage
+          - document.write() with user input
+          - postMessage without origin validation
+          - localStorage for sensitive data storage
+          - Missing CSP headers
+          - Unvalidated redirects (window.location = userInput)
+          - Missing integrity attributes on CDN resources
+          - console.log() with sensitive data
+          - Exposed API keys/endpoints in frontend code
+          ```
+          ### Terraform Infrastructure:
+          ```hcl
+          # Check for:
+          - Security groups with 0.0.0.0/0 ingress
+          - IAM policies with "*" actions/resources
+          - Unencrypted storage (S3, RDS, EBS)
+          - Public S3 buckets or objects
+          - Missing KMS encryption
+          - Default VPC usage
+          - Hardcoded secrets in variables/locals
+          - Missing versioning on critical resources
+          - Disabled logging/monitoring
+          - Over-permissive assume role policies
+          ```
+          ## Review Output Format
+          For each finding, provide:
+          ```
+          :red_circle: CRITICAL | :large_yellow_circle: HIGH | :large_orange_circle: MEDIUM | :large_blue_circle: LOW
+          **Issue:** [Vulnerability type]
+          **Location:** [File:Line]
+          **Risk:** [Brief explanation of potential exploit]
+          **Fix:**
+          ```[Secure code example]```
+          **Reference:** [OWASP/CWE ID if applicable]
+          ```
+          ## Additional Checks
+          1. **Dependencies:**
+             - Run security audit on package.json/requirements.txt/go.mod
+             - Check for known CVEs in dependencies
+             - Verify dependency sources are trusted
+          2. **Secrets Detection:**
+             - Scan for patterns: API keys, passwords, tokens, certificates
+             - Check .env files are gitignored
+             - Verify no sensitive data in comments
+          3. **Configuration:**
+             - Ensure secure defaults (fail closed)
+             - Verify least privilege principle
+             - Check for defense-in-depth implementation
+          4. **Data Flow:**
+             - Trace user input from entry to processing
+             - Verify all boundaries have validation
+             - Ensure proper encoding at each layer
+          ## Summary Requirements
+          At the end of review, provide:
+          1. Security score: PASS :white_check_mark: | FAIL :x:
+          2. Count by severity: Critical(X), High(X), Medium(X), Low(X)
+          3. Must-fix items before merge
+          4. Recommended improvements
+          5. Positive security practices observed
+          ## Review Principles
+          - Assume all input is malicious
+          - Verify trust boundaries
+          - Check fail-safe defaults
+          - Validate defense-in-depth
+          - Ensure least privilege
+          - Confirm secure communication
+          - Verify proper error handling
+          - Check audit logging presence
+          Focus only on security. Do not comment on code style, performance, or non-security bugs unless they have security implications.
+
+          EOF
+
+      - uses: anthropics/claude-code-security-review@68982a6bf10d545e94dd0390af08306d94ef684c
+        with:
+          comment-pr: true
+          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}
+          run-every-commit: true
+          custom-security-scan-instructions: custom_instruction.md
+          claude-model: claude-sonnet-4-5-20250929
+
+      - name: Send Failure Notification to Slack
+        if: failure()
+        uses: slackapi/slack-github-action@6c661ce58804a1a20f6dc5fbee7f0381b469e001
+        with:
+          # For posting a rich message using Block Kit
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": ":red-alert: *Security NCLC Review Checks Failed*"
+                  }
+                },
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "`Workflow Run:` ${{ env.WORKFLOW_RUN_URL }}\n\n`Pull Request:` ${{ env.PR_URL }}\n\n`Head Commit:` ${{ env.PR_HEAD_COMMIT_URL }}\n\n`PR Creator:` *${{ env.PR_CREATOR }}*\n\n`Latest Committer:` *${{ env.GITHUB_SENDER }}*\n\n"
+                  }
+                }
+              ]
+            }