Flo and Claude Opus 4.8
aac1fa7351
fix(security): fix CVSS parsing and Claude prompt
...
CI / Test (1.22) (push) Has been cancelled
CI / Test (1.23) (push) Has been cancelled
CI / Lint (push) Has been cancelled
CI / Vulnerability Check (push) Has been cancelled
CI / Format Check (push) Has been cancelled
OSV returns severity.score as a CVSS vector string, not a number, so
unmarshalling into float64 errored and every vuln was dropped. Read it
as a string, compute the CVSS v3 base score from the vector, and fall
back to the database_specific severity label otherwise.
Invoke the analysis via "claude -p" instead of a nonexistent "ask"
subcommand (which made the CLI treat "ask" as the prompt), and request
strict JSON so recommendations are parsed reliably rather than by
substring matching.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg
2026-06-23 15:30:05 +02:00
Claude and Claude Haiku 4.5
f8adf0669c
Initial project scaffold: macOS package security audit tool
...
CI / Test (1.22) (push) Has been cancelled
CI / Test (1.23) (push) Has been cancelled
CI / Lint (push) Has been cancelled
CI / Vulnerability Check (push) Has been cancelled
CI / Format Check (push) Has been cancelled
This commit establishes the foundation for a comprehensive security audit
tool for macOS developer machines. It audits all installed software,
detects vulnerabilities via OSV.dev, and provides Claude-powered
mitigation recommendations.
## Architecture
- System inventory collection (Homebrew, pip, npm, Go, Rust, apps)
- CVE scanning via OSV.dev API (no auth, unlimited rate limits)
- Claude integration (CLI or SDK) for mitigation analysis
- JSON + HTML report generation
- Full test suite (34+ tests, 7 benchmarks)
- Production-grade linting (11 linters via golangci-lint)
- Vulnerability scanning (govulncheck)
- GitHub Actions CI/CD pipeline
## Key Components
- cmd/audit/: CLI entry point
- internal/inventory/: System inventory parsing
- internal/security/: OSV.dev querying, Claude integration, audit logic
- internal/report/: JSON and HTML report generation
- scripts/collect-inventory.sh: Bash script for system enumeration
## MVP Features
- Homebrew package scanning
- Python/Node/Go/Rust ecosystem scanning
- CVSS-based severity filtering
- Claude-powered recommendations (update/replace/protect/monitor)
- Makefile automation (test, lint, vulnerability checks)
- Pre-commit hooks configuration
## Testing & Quality
- 34+ unit tests with table-driven patterns
- 7 benchmark tests for performance
- 11 configured linters (staticcheck, gosec, revive, etc.)
- Code coverage reporting
- GitHub Actions CI (tests on Go 1.22 & 1.23)
- Pre-commit hook framework
## Documentation
- README.md: Full feature and usage documentation
- QUICKSTART.md: 3-minute setup guide
- TESTING.md: Testing and code quality guide
- QA_SETUP.md: Analysis tooling reference
- DATA_SOURCES_SPEC.md: Vulnerability data source documentation
## Data Sources
- OSV.dev: Primary CVE database (1.8 day latency, no auth needed)
- GitHub Advisories: Supplement for maintainer-created advisories
- OpenSSF Scorecard: Trust signals (repo health/practices)
- Homebrew Formulae API: Package metadata
- CISA KEV: Active exploitation tracking
## Next Steps
Phase 1 (MVP): Complete and tested ✓
Phase 2 (planned): Third-party app scanning, VirusTotal integration
Phase 3 (planned): Historical monitoring, scheduled audits, webhooks
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com >
2026-06-23 04:56:57 -07:00
