Security Scanning (SAST, Secrets, SBOM)
Relevant source files
The following files were used as context for generating this wiki page:
The security scanning system within the opencode-swarm project is a multi-layered verification framework designed to identify vulnerabilities, prevent secret leakage, and maintain a verifiable record of software dependencies. These processes are integrated into the automated Quality Assurance (QA) pipeline and are enforced by specific agent roles and tool gates.
Security scanning is categorized into two stages: Stage A (Automated Tool Gates) and Stage B (Agent Review Gates). Stage A utilizes high-speed automated tools for secret scanning and static analysis, while Stage B involves deep reasoning by the reviewer and sme agents to triage findings and perform adversarial testing.
Sources: src/agents/architect.ts:114-150, src/agents/reviewer.ts:180-200
Static Application Security Testing (SAST)
SAST is implemented as a mandatory gate for code implementation tasks. The system uses automated tools like Semgrep to detect patterns associated with security risks, such as injection vectors or insecure cryptographic usage.
SAST Triage and Logic
The reviewer agent is responsible for "SAST Triage." When SAST findings are provided via the automated gates, the agent evaluates the "taint path" of the code. It dismisses findings as false positives if appropriate sanitizers or type guards are present, or escalates them as true positives if trust boundaries are crossed without validation.
Sources: src/agents/reviewer.ts:182-192
Reviewer Security Focus
Security-focused review passes target specific OWASP Top 10 categories to ensure comprehensive coverage:
- Broken Access Control
- Cryptographic Failures
- Injection
- Insecure Design
- Security Misconfiguration
- Vulnerable Components
- Auth Failures
- Data Integrity Failures
- Logging and Monitoring Failures
- SSRF
Sources: src/agents/reviewer.ts:3-16
Secret Scanning
Secret scanning is a critical component of the pre_check_batch gate. It identifies hardcoded sensitive information before code is approved for merge.
Automated Detection
The architect agent maintains a list of SECURITY_KEYWORDS used to trigger heightened scrutiny. If these keywords are detected in a code change, the system mandates Tier 3 classification, which requires multiple reviewers and adversarial test engineers.
Sources: src/agents/architect.ts:133-138, src/agents/architect.ts:251-255
| Component | Description |
|---|---|
| Pre-check Batch | Concurrently runs lint:check, secretscan, and sast_scan. |
| Security Keywords | Triggers: password, secret, token, key, jwt, api_key, private_key, etc. |
| Tier 3 Execution | Required for changes touching crypto, auth, or secrets. |
Sources: src/agents/architect.ts:133-138, src/agents/architect.ts:251-255, src/agents/architect.ts:805-812
Workflow Security
Adversarial tests also check for secret exposure risks in CI/CD pipelines, specifically looking for direct use of secrets in expressions without masking or patterns where secrets might be exposed in logs via echo or print statements.
Sources: tests/security/ci-workflow-security.test.ts:167-200
Software Bill of Materials (SBOM)
SBOM generation provides transparency into the project's dependency tree and helps identify vulnerable components.
Discovery and Generation
The sbom_generate tool scans the repository for manifest files across multiple ecosystems. It supports:
- Node.js:
package.json,package-lock.json - Python:
requirements.txt - Rust:
Cargo.toml - Go:
go.mod
The tool combines components from all detected manifests into a single JSON manifest following the CycloneDX version 1.5 specification, including Package URLs (PURLs) for each component.
Sources: tests/unit/tools/sbom-generate.test.ts:80-140, tests/unit/tools/sbom-generate.test.ts:210-230
SBOM Generation Flow
The following diagram illustrates how the sbom_generate tool processes manifests:
This diagram shows the logic of manifest discovery, filtering of build artifacts, and multi-ecosystem parsing used to create a unified dependency manifest.
Sources: tests/unit/tools/sbom-generate.test.ts:145-185, tests/unit/tools/sbom-generate.test.ts:285-310
Security Configuration and SME Guidance
The Subject Matter Expert (SME) agent provides deep guidance on security patterns, using established checklists to validate implementation strategies.
SME Security Checklist
- OWASP Top 10 considered for attack surface.
- Input validation strategy defined (allowlist, not denylist).
- Authentication/authorization model (least-privilege).
- Secret management approach (no hardcoded secrets).
- Error messages do not leak internal details.
Sources: src/agents/sme.ts:114-122
Architect Security Orchestration
The Architect manages the security posture through configuration flags that can force mandatory security passes regardless of the file patterns detected.
| Flag | Effect |
|---|---|
always_security_review | Forces a security-only reviewer pass for all tasks. |
sast_enabled | Enables static security scanning (default: ON). |
secretscan | Enables hardcoded secret detection (default: ON). |
Sources: src/hooks/system-enhancer.ts:580-590, src/agents/architect.ts:1010-1025
Summary
Security Scanning in the opencode-swarm project is a comprehensive system combining automated tool gates and intelligent agent oversight. By integrating SAST triage, automated secret scanning with high-sensitivity keyword detection, and multi-ecosystem SBOM generation, the project ensures that code changes are not only functional but also secure and transparent. This framework enforces the principle of least privilege and strict adherence to the OWASP Top 10, protecting the project from both internal vulnerabilities and external dependency risks.