Chisel Security Scanning

Overview

Chisel's security scanning service surfaces CI pipeline security findings (SAST via Bandit, dependency scanning via Safety) across all tracked repositories. Findings are severity-categorized and can be auto-remediated by creating deduplicated GitLab issues.

Scanning Pipeline

1. Fetches latest CI pipeline for each repository
2. Tries GitLab Vulnerability Findings API first
3. Falls back to parsing pipeline job trace output
4. Categorizes findings by severity: critical, high, medium, low

Auto-Remediation

The SecurityIssueService creates GitLab issues for critical and high findings. Issues include SHA-256 fingerprints embedded as HTML comments for deduplication across repeated scans.

Key Code Paths

File	Purpose
src/services/security_scan_service.py	Fetch and parse CI findings
src/services/security_issue_service.py	Create deduplicated GitLab issues
src/handlers/security_scan_handler.py	/chisel scan Slack commands

Slack Commands

• /chisel scan -- Cross-repo security summary
• /chisel scan <repo> -- Detailed findings for a single repo
• /chisel scan remediate [repo] -- Auto-create issues for critical/high findings
• /chisel scan help -- Scan command help