VulnZap Documentation

const VulnZapClient = require('./vulnzapent');

class SecurityMonitor {
  constructor(apiKey) {
    this.client = new VulnZapClient(apiKey);
    this.vulnerabilities = new Map();
  }

  async scanPackageJson(packageJsonPath = './package.json') {
    const packageJson = require(packageJsonPath);
    const dependencies = {
      ...packageJson.dependencies,
      ...packageJson.devDependencies
    };

    const packages = Object.entries(dependencies).map(([name, version]) => ({
      name,
      version: version.replace(/^[^\d]*/, '') // Remove ^ ~ etc.
    }));

    try {
      const results = await this.client.batchScan(packages);
      return this.processResults(results);
    } catch (error) {
      console.error('Security scan failed:', error.message);
      throw error;
    }
  }

  processResults(results) {
    const vulnerabilities = [];
    const summary = {
      totalPackages: results.data.summary.total_packages,
      vulnerablePackages: results.data.summary.vulnerable_packages,
      totalVulnerabilities: results.data.summary.total_vulnerabilities,
      riskScore: results.data.summary.average_risk_score
    };

    results.data.results.forEach(result => {
      if (result.status === 'vulnerable') {
        vulnerabilities.push({
          package: result.package,
          version: result.version,
          vulnerabilityCount: result.vulnerabilities,
          riskScore: result.risk_score
        });
      }
    });

    return { vulnerabilities, summary };
  }

  async generateReport(format = 'json') {
    const scanResults = await this.scanPackageJson();
    
    if (format === 'json') {
      return JSON.stringify(scanResults, null, 2);
    }
    
    if (format === 'markdown') {
      return this.generateMarkdownReport(scanResults);
    }

    throw new Error(`Unsupported format: ${format}`);
  }

  generateMarkdownReport({ vulnerabilities, summary }) {
    let report = `# Security Scan Report\n\n`;
    report += `**Scan Date:** ${new Date().toISOString()}\n\n`;
    report += `## Summary\n\n`;
    report += `- **Total Packages:** ${summary.totalPackages}\n`;
    report += `- **Vulnerable Packages:** ${summary.vulnerablePackages}\n`;
    report += `- **Total Vulnerabilities:** ${summary.totalVulnerabilities}\n`;
    report += `- **Average Risk Score:** ${summary.riskScore.toFixed(2)}\n\n`;

    if (vulnerabilities.length > 0) {
      report += `## Vulnerabilities Found\n\n`;
      vulnerabilities.forEach(vuln => {
        report += `### ${vuln.package}@${vuln.version}\n`;
        report += `- **Vulnerabilities:** ${vuln.vulnerabilityCount}\n`;
        report += `- **Risk Score:** ${vuln.riskScore}\n\n`;
      });
    } else {
      report += `## No Vulnerabilities Detected\n\nAll dependencies are secure.\n`;
    }

    return report;
  }
}

module.exports = SecurityMonitor;

class VulnZapClient {
  constructor(apiKey) {
    this.apiKey = apiKey;
    this.baseUrl = 'https://api.vulnzap.com/v1';
  }

  async makeRequest(endpoint, options = {}) {
    const url = `${this.baseUrl}${endpoint}`;
    const headers = {
      'Authorization': `Bearer ${this.apiKey}`,
      'Content-Type': 'application/json',
      ...options.headers
    };

    const response = await fetch(url, {
      ...options,
      headers
    });

    if (!response.ok) {
      const error = await response.json();
      throw new Error(`API Error: ${error.message}`);
    }

    return response.json();
  }

  async scanPackage(packageName, version) {
    const endpoint = `/scan?package=${packageName}&version=${version}`;
    return this.makeRequest(endpoint);
  }

  async batchScan(packages) {
    const endpoint = '/scan/batch';
    return this.makeRequest(endpoint, {
      method: 'POST',
      body: JSON.stringify({ packages })
    });
  }
}

module.exports = VulnZapClient;

const SecurityMonitor = require('./security-monitor');

async function main() {
  const monitor = new SecurityMonitor(process.env.VULNZAP_API_KEY);

  try {
    console.log('Starting security scan...');
    
    const report = await monitor.generateReport('markdown');
    console.log(report);

    // Save report to file
    const fs = require('fs');
    fs.writeFileSync('security-report.md', report);
    
    console.log('Security report saved to security-report.md');
  } catch (error) {
    console.error('Security scan failed:', error.message);
    process.exit(1);
  }
}

if (require.main === module) {
  main();
}

FROM node:18-alpine

WORKDIR /app

# Copy package files
COPY package*.json ./

# Install dependencies
RUN npm ci --only=production

# Security scan step
ARG VULNZAP_API_KEY
ENV VULNZAP_API_KEY=${VULNZAP_API_KEY}

# Run security scan and fail build if vulnerabilities found
RUN npx vulnzap@latest init && \
    npx vulnzap@latest batch-scan --fail-on=high --format=json || \
    (echo "High severity vulnerabilities detected. Build failed." && exit 1)

# Copy application code
COPY . .

# Create non-root user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nextjs -u 1001

USER nextjs

EXPOSE 3000

CMD ["npm", "start"]

version: '3.8'

services:
  app:
    build:
      context: .
      args:
        VULNZAP_API_KEY: ${VULNZAP_API_KEY}
    environment:
      - NODE_ENV=production
    ports:
      - "3000:3000"
    restart: unless-stopped

  security-scanner:
    image: node:18-alpine
    volumes:
      - ./:/app
    working_dir: /app
    environment:
      - VULNZAP_API_KEY=${VULNZAP_API_KEY}
    command: >
      sh -c "
        npm install &&
        npx vulnzap@latest init &&
        npx vulnzap@latest batch-scan --format=json --output=/app/security-report.json
      "
    profiles:
      - security

import requests
import json
import os
from typing import List, Dict, Optional

class VulnZapClient:
    def __init__(self, api_key: str):
        self.api_key = api_key
        self.base_url = "https://api.vulnzap.com/v1"
        self.session = requests.Session()
        self.session.headers.update({
            "Authorization": f"Bearer {api_key}",
            "Content-Type": "application/json"
        })

    def scan_package(self, package: str, version: Optional[str] = None) -> Dict:
        """Scan a single package for vulnerabilities."""
        params = {"package": package}
        if version:
            params["version"] = version
            
        response = self.session.get(f"{self.base_url}/scan", params=params)
        response.raise_for_status()
        return response.json()

    def batch_scan(self, packages: List[Dict[str, str]]) -> Dict:
        """Scan multiple packages at once."""
        payload = {"packages": packages}
        response = self.session.post(
            f"{self.base_url}/scan/batch", 
            json=payload
        )
        response.raise_for_status()
        return response.json()

    def scan_requirements_file(self, file_path: str = "requirements.txt") -> Dict:
        """Scan packages from a requirements.txt file."""
        packages = []
        
        with open(file_path, 'r') as f:
            for line in f:
                line = line.strip()
                if line and not line.startswith('#'):
                    if '==' in line:
                        name, version = line.split('==')
                        packages.append({"name": name.strip(), "version": version.strip()})
                    else:
                        packages.append({"name": line.strip()})
        
        return self.batch_scan(packages)

def main():
    api_key = os.getenv("VULNZAP_API_KEY")
    if not api_key:
        raise ValueError("VULNZAP_API_KEY environment variable is required")
    
    client = VulnZapClient(api_key)
    
    try:
        print("Scanning requirements.txt...")
        results = client.scan_requirements_file()
        
        summary = results["data"]["summary"]
        print(f"\nScan Summary:")
        print(f"  Total packages: {summary['total_packages']}")
        print(f"  Vulnerable packages: {summary['vulnerable_packages']}")
        print(f"  Total vulnerabilities: {summary['total_vulnerabilities']}")
        print(f"  Average risk score: {summary['average_risk_score']:.2f}")
        
        if summary["vulnerable_packages"] > 0:
            print("\nVulnerable packages:")
            for result in results["data"]["results"]:
                if result["status"] == "vulnerable":
                    print(f"  {result['package']}@{result['version']} "
                          f"({result['vulnerabilities']} vulnerabilities, "
                          f"risk score: {result['risk_score']})")
        else:
            print("\nNo vulnerabilities detected.")
            
    except requests.RequestException as e:
        print(f"API request failed: {e}")
    except Exception as e:
        print(f"Error: {e}")

if __name__ == "__main__":
    main()