elmming/devsecopslab

How elmming/devsecopslab works

DevSecOps Lab automates vulnerability detection, patching, validation, and audit. The main flow is CI/SAST findings imported into DefectDojo, then handled by either the cloud remediation script or the local RAG pipeline; the latter retrieves coding guidance before generating patches. Validation gates and rollback protect repository changes, while the pipelines record audit events and send alerts. The experiment runner benchmarks both approaches. Relationships for documented but unsampled services rely on the README; no finer-grained source behavior is inferred.

Main entry points: auto_remediate.py Cloud Remediator · auto_remediate_rag.py RAG Remediator · experiment_runner.py Pipeline Benchmark · blockchain_ledger.py Audit Ledger

Components 20

Detection & Intake

OneDev CI/CD
SonarQube SAST
Finding Import import_to_defectdojo.py
DefectDojo

Remediation & Validation

Cloud Remediator auto_remediate.py
RAG Remediator auto_remediate_rag.py
Secure Coding Rules Secure_Coding_Guidelines.txt
ChromaDB Vector Store
Cloud LLM
Ollama Local LLM
Compile, Test, SAST
Vulnerable Spring App vulnerable-spring-boot
Git Branch / Rollback

Trust & Audit

AWS Secrets Manager
HashiCorp Vault vault_client.py
Environment Secrets .env.example
Audit Ledger blockchain_ledger.py
Telegram Alerts telegram_notifier.py

Evaluation

Pipeline Benchmark experiment_runner.py

Other components

Developer

Connections 26

Developer → OneDev CI/CD: pushes code README.md
OneDev CI/CD → SonarQube SAST: triggers scan README.md
SonarQube SAST → Finding Import: provides scan results import_to_defectdojo.py
Finding Import → DefectDojo: imports findings import_to_defectdojo.py
DefectDojo → Cloud Remediator: supplies findings auto_remediate.py
DefectDojo → RAG Remediator: supplies findings README.md
RAG Remediator → ChromaDB Vector Store: retrieves rules README.md
Secure Coding Rules → ChromaDB Vector Store: provides rule corpus README.md
Cloud Remediator → Cloud LLM: generates patches auto_remediate.py
RAG Remediator → Ollama Local LLM: generates patches README.md
Cloud Remediator → Compile, Test, SAST: validates patch README.md
RAG Remediator → Compile, Test, SAST: runs three gates auto_remediate_rag.py
Compile, Test, SAST → Vulnerable Spring App: checks changes README.md
Cloud Remediator → Git Branch / Rollback: commits or rolls back auto_remediate.py
RAG Remediator → Git Branch / Rollback: pushes or rolls back README.md
Cloud Remediator → AWS Secrets Manager: loads secrets auto_remediate.py
Cloud Remediator → HashiCorp Vault: fallback secret lookup auto_remediate.py
Cloud Remediator → Environment Secrets: fallback secret lookup README.md
RAG Remediator → Audit Ledger: records events auto_remediate_rag.py
Cloud Remediator → Audit Ledger: records findings and outcomes auto_remediate.py
RAG Remediator → Telegram Alerts: sends alerts auto_remediate_rag.py
Cloud Remediator → Telegram Alerts: sends alerts README.md
Pipeline Benchmark → Cloud Remediator: benchmarks pipeline A README.md
Pipeline Benchmark → RAG Remediator: benchmarks pipeline B README.md
Pipeline Benchmark → Audit Ledger: records results experiment_runner.py
Pipeline Benchmark → Telegram Alerts: notifies experiment_runner.py

More Python diagrams: canopyai/orpheus-tts · subzeroid/instagrapi · sevask/ecoute · pengxiao-song/lawgpt · yenchenlin/nerf-pytorch

Drawn by GitDiagram on November 9, 2026 from the repository's file tree, README and source files. Read as Markdown ·