.

security/scanning/vulnerability-scanning/scripts/scan-images.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+# Container Image Vulnerability Scanner
+# Usage: ./scan-images.sh <image> [--severity HIGH,CRITICAL] [--format json|table]
+
+set -euo pipefail
+
+IMAGE="${1:-}"
+SEVERITY="${2:-HIGH,CRITICAL}"
+FORMAT="${3:-table}"
+
+if [ -z "$IMAGE" ]; then
+    echo "Usage: $0 <image> [--severity HIGH,CRITICAL] [--format json|table]"
+    exit 1
+fi
+
+echo "========================================="
+echo "Scanning Image: $IMAGE"
+echo "Severity Filter: $SEVERITY"
+echo "========================================="
+echo ""
+
+# Check which scanner is available
+if command -v trivy &>/dev/null; then
+    echo "Using Trivy scanner..."
+    trivy image \
+        --severity "$SEVERITY" \
+        --format "$FORMAT" \
+        --ignore-unfixed \
+        "$IMAGE"
+        
+elif command -v grype &>/dev/null; then
+    echo "Using Grype scanner..."
+    grype "$IMAGE" \
+        --only-fixed \
+        --fail-on high \
+        -o "$FORMAT"
+        
+elif command -v docker &>/dev/null && docker scout version &>/dev/null 2>&1; then
+    echo "Using Docker Scout..."
+    docker scout cves "$IMAGE" \
+        --only-severity critical,high \
+        --format "$FORMAT"
+        
+else
+    echo "Error: No vulnerability scanner found."
+    echo "Install one of: trivy, grype, or docker scout"
+    exit 1
+fi
+
+echo ""
+echo "========================================="
+echo "Scan complete"
+echo "========================================="

security/scanning/vulnerability-scanning/scripts/scan-repo.sh

@@ -0,0 +1,81 @@
+#!/bin/bash
+# Repository Vulnerability Scanner
+# Scans for vulnerabilities in dependencies and IaC
+# Usage: ./scan-repo.sh [directory] [--output report.json]
+
+set -euo pipefail
+
+SCAN_DIR="${1:-.}"
+OUTPUT="${2:-}"
+
+echo "========================================="
+echo "Repository Security Scan"
+echo "Directory: $SCAN_DIR"
+echo "========================================="
+echo ""
+
+ISSUES_FOUND=0
+
+# Trivy filesystem scan
+if command -v trivy &>/dev/null; then
+    echo "=== Trivy Filesystem Scan ==="
+    trivy fs "$SCAN_DIR" \
+        --severity HIGH,CRITICAL \
+        --scanners vuln,secret,config \
+        --ignore-unfixed \
+        || ISSUES_FOUND=1
+    echo ""
+fi
+
+# Check for secrets with gitleaks
+if command -v gitleaks &>/dev/null; then
+    echo "=== GitLeaks Secret Scan ==="
+    gitleaks detect --source "$SCAN_DIR" --no-git || ISSUES_FOUND=1
+    echo ""
+fi
+
+# Check Terraform with tfsec
+if command -v tfsec &>/dev/null && [ -d "$SCAN_DIR" ]; then
+    if find "$SCAN_DIR" -name "*.tf" -print -quit | grep -q .; then
+        echo "=== TFSec Terraform Scan ==="
+        tfsec "$SCAN_DIR" --minimum-severity HIGH || ISSUES_FOUND=1
+        echo ""
+    fi
+fi
+
+# Check Kubernetes manifests with kubesec
+if command -v kubesec &>/dev/null; then
+    for manifest in $(find "$SCAN_DIR" -name "*.yaml" -o -name "*.yml" 2>/dev/null | head -10); do
+        if grep -q "kind:" "$manifest" 2>/dev/null; then
+            echo "=== Kubesec: $manifest ==="
+            kubesec scan "$manifest" 2>/dev/null || true
+        fi
+    done
+fi
+
+# Python dependencies
+if [ -f "$SCAN_DIR/requirements.txt" ]; then
+    if command -v pip-audit &>/dev/null; then
+        echo "=== Python Dependency Audit ==="
+        pip-audit -r "$SCAN_DIR/requirements.txt" || ISSUES_FOUND=1
+        echo ""
+    fi
+fi
+
+# Node.js dependencies
+if [ -f "$SCAN_DIR/package.json" ]; then
+    if command -v npm &>/dev/null; then
+        echo "=== NPM Audit ==="
+        (cd "$SCAN_DIR" && npm audit --audit-level=high 2>/dev/null) || ISSUES_FOUND=1
+        echo ""
+    fi
+fi
+
+echo "========================================="
+if [ $ISSUES_FOUND -eq 1 ]; then
+    echo "⚠ Security issues found - review above"
+    exit 1
+else
+    echo "✓ No critical security issues found"
+fi
+echo "========================================="