streamflow/docs/SECURITY_TESTING.md

Security Testing Configuration

This directory contains security testing tools and configurations for StreamFlow IPTV.

Tools Implemented

SAST (Static Application Security Testing)

1. ESLint Security Plugin

   • Scans JavaScript/Node.js code for security vulnerabilities
   • Detects: SQL injection, XSS, unsafe regex, eval usage, etc.
   • Configuration: backend/.eslintrc.js and frontend/.eslintrc.js

2. Semgrep

   • Advanced static analysis for multiple languages
   • Rules: p/security-audit, p/nodejs, p/javascript, p/express
   • Detects: SQL injection, XSS, command injection, authentication issues

3. NPM Audit

   • Scans dependencies for known vulnerabilities
   • Checks both backend and frontend packages
   • Severity threshold: High

4. Snyk

   • Commercial-grade vulnerability scanning
   • Requires SNYK_TOKEN secret in GitHub
   • Sign up: https://snyk.io

5. Docker Security

   • Trivy: Vulnerability scanner for container images
   • Dockle: Docker image linter for best practices

DAST (Dynamic Application Security Testing)

1. OWASP ZAP
   • Baseline scan: Quick security check
   • Full scan: Comprehensive security analysis
   • Tests running application for vulnerabilities
   • Configuration: .zap/rules.tsv

Running Security Tests

Locally

# Run all local security checks
./scripts/security-check.sh

# Run backend security checks only
cd backend
npm run security:check

# Run frontend security checks only
cd frontend
npm run security:check

# Run specific checks
npm run security:audit  # NPM audit only
npm run security:lint   # ESLint security scan

Automated (CI/CD)

Security scans run automatically on:

• Every push to main or develop branches
• Every pull request
• Daily at 2 AM (scheduled scan)

View results in:

• GitHub Actions → Security Testing workflow
• GitHub Security → Code scanning alerts
• Workflow artifacts (detailed reports)

Pre-commit Hook

The pre-commit hook runs automatically before each commit and checks for:

• High/critical vulnerabilities in dependencies
• Hardcoded passwords or API keys
• Attempts to commit .env files

To bypass (not recommended):

git commit --no-verify

Security Report Artifacts

After each scan, the following artifacts are available:

• eslint-security-reports: ESLint scan results
• npm-audit-reports: NPM audit JSON reports
• zap-scan-reports: OWASP ZAP HTML/JSON/MD reports
• security-summary-report: Overall security summary

Configuration Files

• .github/workflows/security-scan.yml: GitHub Actions workflow
• backend/.eslintrc.js: Backend ESLint security rules
• frontend/.eslintrc.js: Frontend ESLint security rules
• .zap/rules.tsv: OWASP ZAP scanning rules
• scripts/security-check.sh: Local security testing script

Best Practices

1. Run tests before pushing

   ./scripts/security-check.sh
   

2. Review security alerts

   • Check GitHub Security tab regularly
   • Address high/critical vulnerabilities immediately

3. Keep dependencies updated

   npm audit fix
   npm outdated
   

4. Never commit secrets

   • Use environment variables
   • Add sensitive files to .gitignore
   • Use GitHub Secrets for CI/CD

5. Review scan reports

   • Download artifacts from GitHub Actions
   • Investigate all FAIL results from ZAP
   • Fix WARN results when possible

Integration with Snyk (Optional)

To enable Snyk scanning:

1. Sign up at https://snyk.io
2. Get your API token
3. Add as GitHub secret: SNYK_TOKEN
4. Uncomment Snyk job in workflow file

Troubleshooting

Error: "npm audit found vulnerabilities"

• Run npm audit fix in affected directory
• For breaking changes: npm audit fix --force
• Update manually: npm update <package>

Error: "ESLint security issues found"

• Review output for security violations
• Fix issues or add ESLint disable comments with justification
• Never disable security rules without review

ZAP scan failures

• Review ZAP HTML report in artifacts
• Check .zap/rules.tsv configuration
• Some warnings may be false positives

Additional Resources

• OWASP Top 10
• Semgrep Rules
• ESLint Security Plugin
• OWASP ZAP