Security Compliance & Vulnerability Scanning

[sonoflawal]

closes #187

Implements a comprehensive security compliance and vulnerability scanning framework that continuously assesses the platform's security posture against PCI DSS principles, OWASP API Security Top 10, and African financial regulatory requirements.

What's changed
New module: src/security_compliance/

models.rs — domain types for vulnerabilities, severity/status/source enums, allowlist entries, posture snapshots, compliance reports, and all HTTP request/response shapes
config.rs — env-driven configuration with configurable SLA deadlines (critical=24h, high=7d, medium=30d, low=90d), posture thresholds, and worker intervals
scoring.rs — age-weighted posture score formula: penalty scales from 1× at discovery to 3× at SLA deadline, incentivising rapid remediation; score floors at 0
repository.rs — full sqlx repository covering vulnerability CRUD, allowlist management, posture snapshot upserts, compliance report persistence, and scan run recording
handlers.rs — 9 admin endpoints covering the full vulnerability lifecycle plus posture, allowlist, and report access
metrics.rs — Prometheus gauges for open vulnerability counts per severity, compliance posture score, days-until-SLA-breach per open vulnerability, and lifecycle event counters
worker.rs — background worker running hourly SLA breach detection with structured error-level log alerts, daily posture computation and persistence, and monthly compliance report generation on the 1st of each month
tests.rs — 16 unit tests covering posture scoring, age multiplier bounds, SLA deadline computation, allowlist expiry enforcement, breach detection, and domain breakdown grouping
Database migration:
20260404000000_security_compliance_framework.sql

Five tables with proper indexes and PostgreSQL enum types: security_vulnerabilities, security_vulnerability_history, security_vuln_allowlist, security_posture_snapshots, security_compliance_reports, security_scan_runs.

CI/CD pipeline:
security-compliance.yml

cargo audit on every PR and main branch merge — fails build on new critical/high advisories
Daily scheduled dependency scan to catch new advisories published between code changes
Security-focused clippy SAST with integer arithmetic, unwrap, and unsafe lints as errors
Gitleaks secrets detection scanning full git history on first integration
Trivy container image scanning — blocks image push on critical/high CVEs
Weekly production image rescan against updated CVE databases
Findings ingestion step posts scan results to the vulnerability management API
Supporting config:
audit.toml
updated with deny policy; .clippy.toml security lint profile; .gitleaks.toml with Aframp-specific secret patterns (Stellar keys, JWT secrets, API key format).

Integration tests:
security_compliance_integration.rs
— 9 tests covering the full vulnerability lifecycle (ingest → acknowledge → resolve → accept-risk), allowlist enforcement including expiry, posture snapshot persistence, compliance report generation, SLA deadline accuracy, and paginated listing.

[drips-wave]

@sonoflawal Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[sonoflawal]

conflit solved.