┌─────────────────────────────────────────────────────────────────┐
│                        User Request                              │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                     SecureLLMProvider                            │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────────────┐  │
│  │  DLP Scanner │  │ Content      │  │  LLM Audit Logger    │  │
│  │  (Pre/Post)  │  │ Filter       │  │  (DB + SIEM)         │  │
│  └──────────────┘  └──────────────┘  └──────────────────────┘  │
└─────────────────────────────────────────────────────────────────┘
         │                    │                    │
         ▼                    ▼                    ▼
┌──────────────┐     ┌──────────────┐     ┌──────────────────────┐
│  DLP Actions │     │ BaseLLMProv. │     │   SIEM Dispatcher    │
│  BLOCK/MASK  │     │ (GigaChat)   │     │  ┌────┐┌────┐┌────┐ │
│  /WARN/LOG   │     │              │     │  │Sys ││CEF ││LEEF│ │
└──────────────┘     └──────────────┘     │  │Log ││    ││    │ │
         │                                 │  └────┘└────┘└────┘ │
         ▼                                 └──────────────────────┘
┌──────────────┐                                    │
│ DLP Webhook  │                                    ▼
│ (External)   │                           ┌──────────────┐
└──────────────┘                           │    SIEM      │
                                           │  (Splunk/    │
┌──────────────┐                           │   QRadar)    │
│ HashiCorp    │◄── Secret Rotation        └──────────────┘
│ Vault        │
└──────────────┘

export SECURITY_ENABLED=true
export SIEM_ENABLED=true
export DLP_ENABLED=true

security:
  # Master switch
  enabled: true

  # LLM Logging
  llm_logging:
    enabled: true
    log_prompts: true
    redact_prompts: true
    max_prompt_length: 2000
    log_responses: true
    log_token_usage: true
    log_latency: true
    log_to_database: true

  # SIEM
  siem:
    enabled: true
    syslog:
      enabled: true
      protocol: "tls"  # udp, tcp, tls
      host: "siem.company.com"
      port: 6514
      facility: 16  # local0
      app_name: "codegraph"
    cef:
      enabled: true
      host: "arcsight.company.com"
      port: 514
    leef:
      enabled: false

  # DLP
  dlp:
    enabled: true
    pre_request:
      enabled: true
      default_action: "WARN"
    post_response:
      enabled: true
      default_action: "MASK"
    categories:
      credentials:
        enabled: true
        action: "BLOCK"
        severity: "critical"
      pii:
        enabled: true
        action: "MASK"
        severity: "high"
    webhook:
      enabled: true
      endpoint: "https://dlp.company.com/api/alerts"
      notify_on: ["BLOCK", "WARN"]

  # Vault
  vault:
    enabled: true
    url: "https://vault.company.com:8200"
    auth_method: "approle"
    secrets_mount_point: "secret"
    llm_secrets_path: "codegraph/llm"

from src.llm import create_llm_provider

# Provider is automatically wrapped with security layer
provider = create_llm_provider()

# All requests are now filtered and logged
response = provider.generate(
    system_prompt="You are a code analyst",
    user_prompt="Analyze this function",
)

from src.llm import GigaChatProvider
from src.security import get_security_config, SecureLLMProvider

# Create base provider
base_provider = GigaChatProvider(config)

# Wrap with security
secure_provider = SecureLLMProvider(
    wrapped_provider=base_provider,
    config=get_security_config()
)

# Use secure provider
response = secure_provider.generate(
    system_prompt="Analyze code",
    user_prompt="def process_payment(card_number='4111111111111111')...",
    _user_id="user-123",  # Optional: user context
    _ip_address="192.168.1.100",  # Optional: IP for audit
)

from src.security.dlp import ContentScanner
from src.security.config import get_security_config

config = get_security_config()
scanner = ContentScanner(config.dlp)

# Scan content
result = scanner.scan_request("API_KEY=sk-1234567890abcdef")

if result.blocked:
    print(f"Content blocked! Matches: {result.matches}")
elif result.has_matches:
    print(f"Sensitive data found: {result.matches}")
    # Use masked content
    safe_content = result.modified_content

from src.security.siem import (
    SecurityEvent, SecurityEventType,
    init_siem_dispatcher
)
from src.security.config import get_security_config

# Initialize dispatcher
dispatcher = init_siem_dispatcher(get_security_config().siem)

# Create and dispatch event
event = SecurityEvent.create(
    event_type=SecurityEventType.DLP_BLOCK,
    message="Credentials detected in LLM request",
    severity=3,  # Error
    user_id="user-123",
    request_id="req-456",
    details={"pattern": "aws_key", "category": "credentials"}
)

dispatcher.dispatch(event)

dlp:
  categories:
    custom:
      enabled: true
      action: "WARN"
      severity: "medium"
      patterns:
        - name: "project_code"
          regex: "PROJECT-[A-Z]{2,4}-\d{4,6}"
          mask_with: "[PROJECT-ID]"

<134>1 2024-12-09T10:30:00.000Z codegraph.company.com codegraph - llm.dlp.block [llm@12345 requestId="req-123" userId="user-456" provider="GigaChat" action="BLOCK" category="credentials"] DLP BLOCK: 2 patterns in request

CEF:0|CodeGraph|CodeAnalysis|1.0|llm.dlp.block|DLP Block|7|rt=Dec 09 2024 10:30:00 src=192.168.1.100 suser=user-456 cs1=req-123 cs1Label=RequestID cs2=GigaChat cs2Label=Provider act=BLOCK cat=credentials

LEEF:2.0|CodeGraph|CodeAnalysis|1.0|llm.dlp.block|  devTime=Dec 09 2024 10:30:00    src=192.168.1.100   usrName=user-456    requestId=req-123   provider=GigaChat   action=BLOCK    category=credentials

{
  "alert_id": "a1b2c3d4e5f6",
  "timestamp": "2024-12-09T10:30:00.000Z",
  "action": "BLOCK",
  "match_count": 2,
  "categories": ["credentials"],
  "patterns": ["api_key", "aws_key"],
  "request_id": "req-123",
  "user_id": "user-456",
  "ip_address": "192.168.1.100",
  "severity": "critical",
  "context": {}
}

from src.security.file_scanner import FileSecurityScanner

scanner = FileSecurityScanner()
result = scanner.scan("/path/to/project")

print(f"Critical: {result.critical_count}")
print(f"High: {result.high_count}")

for finding in result.findings:
    print(f"{finding.severity}: {finding.description}")
    print(f"  File: {finding.file_path}:{finding.line_number}")

# Quick scan
python -m src.cli.security_audit quick --path ./myproject

# Full scan with report
python -m src.cli.security_audit full --path ./myproject --format all

# Django request data
request.GET, request.POST, request.data
request.body, request.FILES, request.META

# Flask request data
request.args, request.form, request.json

# Generic input
input(), raw_input(), sys.stdin, os.getenv()

# File/Network input
open(), read(), recv(), urlopen()

from src.security.taint_verified_scanner import TaintVerifiedScanner

scanner = TaintVerifiedScanner(duckdb_path="cpg.duckdb")

# Verify SQL injection findings
verified = scanner.verify_sql_injection_findings(raw_findings)

for finding in verified:
    print(f"Confirmed: {finding['description']}")
    print(f"Taint path: {finding['taint_path']}")

from src.security.hardening import HardeningScanner

scanner = HardeningScanner(duckdb_path="cpg.duckdb")
results = scanner.run_all_checks()

for result in results:
    print(f"[{result.check.d3fend_id}] {result.check.d3fend_name}")
    print(f"  Violations: {len(result.violations)}")
    print(f"  Remediation: {result.check.remediation}")

security:
  hardening:
    enabled: true
    checks:
      D3-VI: true    # Variable Initialization
      D3-CS: true    # Credential Scrubbing
      D3-NPC: true   # Null Pointer Checking
    severity_threshold: "medium"  # Skip low severity

from src.security.sast_comparison import SASTComparison

comparison = SASTComparison(project_path="./myproject")

# Compare with Bandit
result = comparison.compare_with_bandit(our_findings)

print(f"Precision: {result.precision:.2%}")
print(f"Recall: {result.recall:.2%}")
print(f"F1 Score: {result.f1_score:.2%}")
print(f"Unique to us: {len(result.only_ours)}")
print(f"Missed by us: {len(result.only_theirs)}")

# Compare with Bandit
python -m src.cli.security_audit full --path ./myproject --compare bandit

# Compare with Semgrep
python -m src.cli.security_audit full --path ./myproject --compare semgrep

from src.security.report_generator import SecurityReportGenerator

generator = SecurityReportGenerator(language="en")

# Generate report from scan results
report = generator.generate(
    project_name="MyProject",
    project_path="./myproject",
    file_findings=file_scan.findings,
    cpg_findings=cpg_scan.findings,
    hardening_findings=hardening_results,
)

# Export to different formats
generator.export_json(report, "report.json")
generator.export_markdown(report, "report.md")
generator.export_sarif(report, "report.sarif")

from src.security.cpg_context_resolver import CPGContextResolver

resolver = CPGContextResolver(duckdb_path="cpg.duckdb")

# Enrich finding with context
enriched = resolver.enrich_finding(finding)

print(f"Callers: {enriched['callers']}")
print(f"Data flow: {enriched['data_flow_path']}")
print(f"Module: {enriched['module']}")

src/security/
├── __init__.py          # Module exports
├── _base.py             # Base classes (Severity, Category)
├── config.py            # Security configuration
│
├── dlp/                 # Data Loss Prevention
│   ├── patterns.py      # DLP patterns (credentials, PII)
│   ├── scanner.py       # Content scanner
│   ├── actions.py       # DLP actions (BLOCK, MASK, WARN)
│   └── webhook.py       # Alert webhooks
│
├── siem/                # SIEM Integration
│   ├── base_handler.py  # Base handler class
│   ├── syslog_handler.py
│   ├── cef_handler.py
│   ├── leef_handler.py
│   ├── buffer.py        # Event buffering
│   └── dispatcher.py    # Multi-handler dispatch
│
├── vault/               # HashiCorp Vault
│   ├── client.py        # Vault API client
│   └── secret_manager.py
│
├── llm/                 # LLM Security
│   ├── secure_provider.py  # SecureLLMProvider wrapper
│   └── request_logger.py   # Audit logging
│
├── hardening/           # D3FEND Hardening
│   ├── base.py          # Check definitions
│   ├── d3fend_checks.py # All D3FEND checks
│   └── hardening_scanner.py
│
├── patterns/            # Vulnerability Patterns
│   ├── injection.py     # SQL/Command injection
│   ├── memory.py        # Memory safety
│   ├── crypto.py        # Cryptographic issues
│   ├── auth.py          # Authentication flaws
│   ├── concurrency.py   # Race conditions
│   └── python_django.py # Python/Django specific
│
├── file_scanner.py      # File-based scanning
├── taint_verified_scanner.py  # Taint analysis
├── cpg_context_resolver.py    # CPG enrichment
├── sast_comparison.py   # SAST tool comparison
├── report_generator.py  # Report generation
└── report_localizer.py  # i18n support

# Environment variables
export SECURITY_ENABLED=true
export DLP_ENABLED=true
export SIEM_ENABLED=true

# Full audit with all checks
python -m src.cli.security_audit full \
    --path ./myproject \
    --format all \
    --verbose

# Reports are saved to ./security_reports/
ls security_reports/
# security_audit_20241209_103000.json
# security_audit_20241209_103000.md
# security_audit_20241209_103000.sarif

# .github/workflows/security.yml
- name: Security Audit
  run: |
    python -m src.cli.security_audit full \
      --path . \
      --format sarif \
      --output security.sarif

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: security.sarif