# elmming/devsecopslab architecture

> Architecture diagram of the GitHub repository elmming/devsecopslab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/elmming/devsecopslab
- Repository: https://github.com/elmming/devsecopslab

## Overview

DevSecOps Lab automates vulnerability detection, patching, validation, and audit. The main flow is CI/SAST findings imported into DefectDojo, then handled by either the cloud remediation script or the local RAG pipeline; the latter retrieves coding guidance before generating patches. Validation gates and rollback protect repository changes, while the pipelines record audit events and send alerts. The experiment runner benchmarks both approaches. Relationships for documented but unsampled services rely on the README; no finer-grained source behavior is inferred.

Main entry points: [`auto_remediate.py`](https://github.com/elmming/devsecopslab/blob/main/auto_remediate.py) (Cloud Remediator), [`auto_remediate_rag.py`](https://github.com/elmming/devsecopslab/blob/main/auto_remediate_rag.py) (RAG Remediator), [`experiment_runner.py`](https://github.com/elmming/devsecopslab/blob/main/experiment_runner.py) (Pipeline Benchmark), [`blockchain_ledger.py`](https://github.com/elmming/devsecopslab/blob/main/blockchain_ledger.py) (Audit Ledger)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_scan["Detection & Intake"]
  node_onedev["OneDev CI/CD"]
  node_sonar["SonarQube SAST"]
  node_importer["Finding Import"]
  node_dojo[("DefectDojo")]
end

subgraph group_patch["Remediation & Validation"]
  node_cloudfix["Cloud Remediator<br/>[auto_remediate.py]"]
  node_ragfix["RAG Remediator"]
  node_rules["Secure Coding Rules"]
  node_chroma[("ChromaDB Vector Store")]
  node_cloudllm["Cloud LLM"]
  node_ollama["Ollama Local LLM"]
  node_validation["Compile, Test, SAST"]
  node_app["Vulnerable Spring App"]
  node_git["Git Branch / Rollback"]
end

subgraph group_security["Trust &amp; Audit"]
  node_aws[("AWS Secrets Manager")]
  node_vault[("HashiCorp Vault<br/>[vault_client.py]")]
  node_env["Environment Secrets<br/>[.env.example]"]
  node_ledger[("Audit Ledger")]
  node_telegram["Telegram Alerts"]
end

subgraph group_research["Evaluation"]
  node_benchmark["Pipeline Benchmark"]
end

node_developer(("Developer"))

node_developer -->|"pushes code"| node_onedev
node_onedev -->|"triggers scan"| node_sonar
node_sonar -->|"provides scan results"| node_importer
node_importer -->|"imports findings"| node_dojo
node_dojo -->|"supplies findings"| node_cloudfix
node_dojo -->|"supplies findings"| node_ragfix
node_ragfix -->|"retrieves rules"| node_chroma
node_rules -->|"provides rule corpus"| node_chroma
node_cloudfix -->|"generates patches"| node_cloudllm
node_ragfix -->|"generates patches"| node_ollama
node_cloudfix -->|"validates patch"| node_validation
node_ragfix -->|"runs three gates"| node_validation
node_validation -->|"checks changes"| node_app
node_cloudfix -->|"commits or rolls back"| node_git
node_ragfix -->|"pushes or rolls back"| node_git
node_cloudfix -->|"loads secrets"| node_aws
node_cloudfix -->|"fallback secret lookup"| node_vault
node_cloudfix -->|"fallback secret lookup"| node_env
node_ragfix -->|"records events"| node_ledger
node_cloudfix -->|"records findings and outcomes"| node_ledger
node_ragfix -->|"sends alerts"| node_telegram
node_cloudfix -.->|"sends alerts"| node_telegram
node_benchmark -.->|"benchmarks pipeline A"| node_cloudfix
node_benchmark -.->|"benchmarks pipeline B"| node_ragfix
node_benchmark -->|"records results"| node_ledger
node_benchmark -->|"notifies"| node_telegram

click node_importer "https://github.com/elmming/devsecopslab/blob/main/import_to_defectdojo.py"
click node_cloudfix "https://github.com/elmming/devsecopslab/blob/main/auto_remediate.py"
click node_ragfix "https://github.com/elmming/devsecopslab/blob/main/auto_remediate_rag.py"
click node_rules "https://github.com/elmming/devsecopslab/blob/main/Secure_Coding_Guidelines.txt"
click node_app "https://github.com/elmming/devsecopslab/tree/main/vulnerable-spring-boot"
click node_vault "https://github.com/elmming/devsecopslab/blob/main/vault_client.py"
click node_env "https://github.com/elmming/devsecopslab/blob/main/.env.example"
click node_ledger "https://github.com/elmming/devsecopslab/blob/main/blockchain_ledger.py"
click node_telegram "https://github.com/elmming/devsecopslab/blob/main/telegram_notifier.py"
click node_benchmark "https://github.com/elmming/devsecopslab/blob/main/experiment_runner.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_onedev,node_sonar,node_importer,node_dojo toneBlue
class node_cloudfix,node_ragfix,node_rules,node_chroma,node_cloudllm,node_ollama,node_validation,node_app,node_git toneAmber
class node_aws,node_vault,node_env,node_ledger,node_telegram toneMint
class node_benchmark toneRose
class node_developer toneIndigo
```

## Components

### Detection & Intake

- **OneDev CI/CD**
- **SonarQube SAST**
- [Finding Import](https://github.com/elmming/devsecopslab/blob/main/import_to_defectdojo.py): `import_to_defectdojo.py`
- **DefectDojo**

### Remediation & Validation

- [Cloud Remediator](https://github.com/elmming/devsecopslab/blob/main/auto_remediate.py): `auto_remediate.py`
- [RAG Remediator](https://github.com/elmming/devsecopslab/blob/main/auto_remediate_rag.py): `auto_remediate_rag.py`
- [Secure Coding Rules](https://github.com/elmming/devsecopslab/blob/main/Secure_Coding_Guidelines.txt): `Secure_Coding_Guidelines.txt`
- **ChromaDB Vector Store**
- **Cloud LLM**
- **Ollama Local LLM**
- **Compile, Test, SAST**
- [Vulnerable Spring App](https://github.com/elmming/devsecopslab/tree/main/vulnerable-spring-boot): `vulnerable-spring-boot`
- **Git Branch / Rollback**

### Trust & Audit

- **AWS Secrets Manager**
- [HashiCorp Vault](https://github.com/elmming/devsecopslab/blob/main/vault_client.py): `vault_client.py`
- [Environment Secrets](https://github.com/elmming/devsecopslab/blob/main/.env.example): `.env.example`
- [Audit Ledger](https://github.com/elmming/devsecopslab/blob/main/blockchain_ledger.py): `blockchain_ledger.py`
- [Telegram Alerts](https://github.com/elmming/devsecopslab/blob/main/telegram_notifier.py): `telegram_notifier.py`

### Evaluation

- [Pipeline Benchmark](https://github.com/elmming/devsecopslab/blob/main/experiment_runner.py): `experiment_runner.py`

### Other components

- **Developer**

## Connections

- Developer → OneDev CI/CD: pushes code (evidence: `README.md`)
- OneDev CI/CD → SonarQube SAST: triggers scan (evidence: `README.md`)
- SonarQube SAST → Finding Import: provides scan results (evidence: `import_to_defectdojo.py`)
- Finding Import → DefectDojo: imports findings (evidence: `import_to_defectdojo.py`)
- DefectDojo → Cloud Remediator: supplies findings (evidence: `auto_remediate.py`)
- DefectDojo → RAG Remediator: supplies findings (evidence: `README.md`)
- RAG Remediator → ChromaDB Vector Store: retrieves rules (evidence: `README.md`)
- Secure Coding Rules → ChromaDB Vector Store: provides rule corpus (evidence: `README.md`)
- Cloud Remediator → Cloud LLM: generates patches (evidence: `auto_remediate.py`)
- RAG Remediator → Ollama Local LLM: generates patches (evidence: `README.md`)
- Cloud Remediator → Compile, Test, SAST: validates patch (evidence: `README.md`)
- RAG Remediator → Compile, Test, SAST: runs three gates (evidence: `auto_remediate_rag.py`)
- Compile, Test, SAST → Vulnerable Spring App: checks changes (evidence: `README.md`)
- Cloud Remediator → Git Branch / Rollback: commits or rolls back (evidence: `auto_remediate.py`)
- RAG Remediator → Git Branch / Rollback: pushes or rolls back (evidence: `README.md`)
- Cloud Remediator → AWS Secrets Manager: loads secrets (evidence: `auto_remediate.py`)
- Cloud Remediator → HashiCorp Vault: fallback secret lookup (evidence: `auto_remediate.py`)
- Cloud Remediator → Environment Secrets: fallback secret lookup (evidence: `README.md`)
- RAG Remediator → Audit Ledger: records events (evidence: `auto_remediate_rag.py`)
- Cloud Remediator → Audit Ledger: records findings and outcomes (evidence: `auto_remediate.py`)
- RAG Remediator → Telegram Alerts: sends alerts (evidence: `auto_remediate_rag.py`)
- Cloud Remediator → Telegram Alerts: sends alerts (evidence: `README.md`)
- Pipeline Benchmark → Cloud Remediator: benchmarks pipeline A (evidence: `README.md`)
- Pipeline Benchmark → RAG Remediator: benchmarks pipeline B (evidence: `README.md`)
- Pipeline Benchmark → Audit Ledger: records results (evidence: `experiment_runner.py`)
- Pipeline Benchmark → Telegram Alerts: notifies (evidence: `experiment_runner.py`)