security-analysis

name	security-analysis
description	Dependabot and security analysis skill for HASTE. Parse alerts, group related vulnerabilities, apply severity rules, and produce structured reports. Use when: 'Dependabot alert', 'security scan', 'vulnerability triage', 'dependency audit', 'npm audit', 'pip audit', 'CVE analysis'.
source	HASTE security practices, OWASP, NVD
domain	security
level	intermediate
agents	["security","security-validation"]
created_date	2026-04-27
last_validated
validated_by
status	draft

Security Analysis

Overview

Structured process for triaging Dependabot alerts, grouping related vulnerabilities, applying severity rules, and producing actionable reports for HASTE's Python and JavaScript dependency stacks.

Key Concepts

HASTE Dependency Landscape

Stack	Location	Tool	Key Risks
Python (API)	api/hastefuncapi/requirements.txt	pip audit	GDAL parsing, Azure SDK, rasterio
Python (Queues)	api/hastefuncqueues/requirements.txt	pip audit	Same as API
Python (Core)	hastelib/pyproject.toml	pip audit	Geospatial libs, ML deps
JavaScript (UI)	ui/package.json	npm audit	FluentUI, MSAL, build tools
JavaScript (Root)	package.json	npm audit	Azurite (dev only)

Severity Rules

Severity	Action	SLA
Critical	Investigate immediately, create issue	Same day
High	Investigate promptly, create issue	3 business days
Medium	Queue for next sprint	Next sprint
Low	Document and track	Backlog

Patterns & Techniques

Alert Triage Process

Step 1: Gather alerts

# Python
pip audit --format json

# JavaScript
npm audit --json

Step 2: Group related vulnerabilities

• Same package, different CVEs → group together
• Same dependency chain → note the root cause package
• Transitive vs direct dependency → prioritize direct

Step 3: Assess HASTE impact For each vulnerability, determine: