Skip to content

Commit 5813433

Browse files
Neiland85Neiland85
authored
Merge pull request #7 from Neiland85/develop
🎯 Production Release v1.1: Complete Infrastructure + Code Quality Enhancement RESUMEN: Transformación completa de NeuroBank de API básica a plataforma bancaria enterprise con infraestructura AWS serverless, seguridad OIDC, y estándares de calidad profesionales. Lista para producción con monitoreo completo y pipelines automatizados. IMPACTO TÉCNICO: 100% infraestructura como código, 0 credenciales de largo plazo, 7/7 tests pasando, seguridad enterprise-grade. PRÓXIMO PASO: Merge → Configure OIDC → Deploy Production → Monitor
2 parents c013bcf + cbad091 commit 5813433

File tree

12 files changed

+1171
-85
lines changed

12 files changed

+1171
-85
lines changed

‎.bandit‎

Lines changed: 106 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,115 @@
11
[bandit]
2-
# Configuración de Bandit para NeuroBank FastAPI Toolkit
2+
# 🔒 Configuración de Bandit Security Scanner para NeuroBank FastAPI Toolkit
3+
# Versión optimizada para aplicaciones bancarias con alta seguridad
34

4-
# Excluir directorios
5-
exclude_dirs = ["/tests", ".venv", "__pycache__"]
5+
# Excluir directorios que no requieren scanning
6+
exclude_dirs = [
7+
"/tests", # Tests pueden usar asserts y mocks
8+
"/app/tests", # Tests específicos de la app
9+
".venv", # Entorno virtual
10+
"venv", # Alternativa de entorno virtual
11+
"__pycache__", # Cache de Python
12+
".pytest_cache", # Cache de pytest
13+
"node_modules", # Si hay dependencias JS
14+
".git" # Control de versiones
15+
]
616

7-
# Saltar tests específicos
17+
# Saltar tests específicos que son false positives o necesarios
818
skips = [
9-
"B101", # assert_used - normal en tests
10-
"B601", # paramiko_calls - no usamos paramiko
11-
"B602", # subprocess_popen_with_shell_equals_true
19+
"B101", # assert_used - Los asserts son normales en tests
20+
"B601", # paramiko_calls - No usamos paramiko
21+
"B602", # subprocess_popen_with_shell_equals_true - Controlado
22+
"B603", # subprocess_without_shell_equals_true - Permitido si es necesario
23+
"B607", # start_process_with_partial_path - Paths relativos OK en algunos casos
1224
]
1325

14-
# Nivel de confianza mínimo para reportar
26+
# Nivel de confianza mínimo para reportar (HIGH para production banking)
1527
confidence = "MEDIUM"
1628

17-
# Formateo de salida
29+
# Nivel de severidad (LOW, MEDIUM, HIGH)
30+
severity = "LOW"
31+
32+
# Formato de salida (txt, json, csv, xml)
1833
format = "json"
34+
35+
# Incluir archivos específicos si es necesario
36+
# include = ["*.py"]
37+
38+
# Configurar plugins específicos (opcional)
39+
# plugins = ["B301", "B302"]
40+
41+
# Número máximo de líneas de código por función antes de warning
42+
max_lines_per_function = 100
43+
44+
# Tests adicionales específicos para aplicaciones bancarias
45+
tests = [
46+
"B102", # exec_used
47+
"B103", # set_bad_file_permissions
48+
"B104", # hardcoded_bind_all_interfaces
49+
"B105", # hardcoded_password_string
50+
"B106", # hardcoded_password_funcarg
51+
"B107", # hardcoded_password_default
52+
"B108", # hardcoded_tmp_directory
53+
"B110", # try_except_pass
54+
"B112", # try_except_continue
55+
"B201", # flask_debug_true
56+
"B301", # pickle
57+
"B302", # pickle_loads
58+
"B303", # md5
59+
"B304", # md5_insecure
60+
"B305", # cipher
61+
"B306", # mktemp_q
62+
"B307", # eval
63+
"B308", # mark_safe
64+
"B309", # httpsconnection
65+
"B310", # urllib_urlopen
66+
"B311", # random
67+
"B312", # telnetlib
68+
"B313", # xml_bad_cElementTree
69+
"B314", # xml_bad_ElementTree
70+
"B315", # xml_bad_expatreader
71+
"B316", # xml_bad_expatbuilder
72+
"B317", # xml_bad_sax
73+
"B318", # xml_bad_minidom
74+
"B319", # xml_bad_pulldom
75+
"B320", # xml_bad_etree
76+
"B321", # ftplib
77+
"B322", # input
78+
"B323", # unverified_context
79+
"B324", # hashlib_insecure_functions
80+
"B325", # tempnam
81+
"B401", # import_telnetlib
82+
"B402", # import_ftplib
83+
"B403", # import_pickle
84+
"B404", # import_subprocess
85+
"B405", # import_xml_etree
86+
"B406", # import_xml_sax
87+
"B407", # import_xml_expat
88+
"B408", # import_xml_minidom
89+
"B409", # import_xml_pulldom
90+
"B410", # import_lxml
91+
"B411", # import_xmlrpclib
92+
"B412", # import_httpoxy
93+
"B413", # import_pycrypto
94+
"B501", # request_with_no_cert_validation
95+
"B502", # ssl_with_bad_version
96+
"B503", # ssl_with_bad_defaults
97+
"B504", # ssl_with_no_version
98+
"B505", # weak_cryptographic_key
99+
"B506", # yaml_load
100+
"B507", # ssh_no_host_key_verification
101+
"B601", # paramiko_calls
102+
"B602", # subprocess_popen_with_shell_equals_true
103+
"B603", # subprocess_without_shell_equals_true
104+
"B604", # any_other_function_with_shell_equals_true
105+
"B605", # start_process_with_a_shell
106+
"B606", # start_process_with_no_shell
107+
"B607", # start_process_with_partial_path
108+
"B608", # hardcoded_sql_expressions
109+
"B609", # linux_commands_wildcard_injection
110+
"B610", # django_extra_used
111+
"B611", # django_rawsql_used
112+
"B701", # jinja2_autoescape_false
113+
"B702", # use_of_mako_templates
114+
"B703", # django_mark_safe
115+
]

‎.safety‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# 🛡️ Safety Security Scanner Configuration para NeuroBank FastAPI Toolkit
2+
# Configuración para análisis de vulnerabilidades en dependencias
3+
4+
[safety]
5+
# Nivel de severidad mínimo para reportar
6+
# Opciones: low, medium, high, critical
7+
minimum_severity = "medium"
8+
9+
# Formato de salida
10+
# Opciones: text, json, bare
11+
output_format = "json"
12+
13+
# Incluir información adicional en el reporte
14+
include_description = true
15+
include_severity = true
16+
include_advisory = true
17+
18+
# Base de datos de vulnerabilidades
19+
# Opciones: safety (default), osv (experimental)
20+
database = "safety"
21+
22+
# Excluir vulnerabilidades específicas por ID (si son false positives)
23+
# ignore = [
24+
# "12345", # Ejemplo: vulnerability ID to ignore
25+
# "67890"
26+
# ]
27+
28+
# Solo verificar dependencias de producción (excluir dev dependencies)
29+
# production_only = true
30+
31+
# Timeout para requests en segundos
32+
timeout = 60
33+
34+
# Proxy settings si es necesario
35+
# proxy_host = ""
36+
# proxy_port = ""
37+
# proxy_protocol = "http"
38+
39+
# Configuración adicional para entornos CI/CD
40+
[ci]
41+
# Fallar el build si se encuentran vulnerabilidades críticas
42+
fail_on_critical = true
43+
fail_on_high = true
44+
fail_on_medium = false
45+
fail_on_low = false
46+
47+
# Output adicional para CI
48+
show_audit_id = true
49+
show_cve = true
50+
show_affected_package = true

0 commit comments

Comments
 (0)