# praneeth-gande/devsecops-pipeline-demo architecture

> Architecture diagram of the GitHub repository praneeth-gande/devsecops-pipeline-demo, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/praneeth-gande/devsecops-pipeline-demo
- Repository: https://github.com/praneeth-gande/devsecops-pipeline-demo

## Overview

This repository is a deliberately vulnerable Flask demo paired with a GitHub Actions security-scanning pipeline. A push starts the workflow, which scans the code and dependencies, applies a HIGH/CRITICAL dependency gate, uploads findings for GitHub code scanning, and generates an SBOM artifact. The app also demonstrates SQL injection, command injection, and debug-mode risks; its planted credentials and vulnerable dependency pins provide scan targets. Pipeline details are based on the README; the workflow source was not sampled, so internal step wiring is shown only where documented.

Main entry points: [`.github/workflows/security-scan.yml`](https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/.github/workflows/security-scan.yml) (Scan workflow), [`app.py`](https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/app.py) (Flask app), [`config.py`](https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/config.py) (Planted credentials), [`requirements.txt`](https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/requirements.txt) (Pinned dependencies)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_demo["Demo application"]
  node_app["Flask app<br/>[app.py]"]
  node_config["Planted credentials<br/>[config.py]"]
  node_dependencies["Pinned dependencies<br/>[requirements.txt]"]
end

subgraph group_pipeline["Security pipeline"]
  node_workflow["Scan workflow<br/>[security-scan.yml]"]
  node_gitleaks["Gitleaks"]
  node_semgrep["Semgrep"]
  node_trivy["Trivy"]
  node_syft["Syft"]
  node_gate{{"Severity gate<br/>[security-scan.yml]"}}
end

subgraph group_outputs["Findings and inventory"]
  node_sarif["SARIF findings"]
  node_security_tab["GitHub Security tab"]
  node_sbom["CycloneDX SBOM"]
  node_artifact["Workflow artifact"]
end

node_developer(("Contributor"))

node_developer -->|"pushes to"| node_workflow
node_workflow -->|"runs scan"| node_gitleaks
node_workflow -->|"runs scan"| node_semgrep
node_workflow -->|"runs scan"| node_trivy
node_workflow -->|"generates SBOM"| node_syft
node_gitleaks -->|"scans"| node_config
node_semgrep -->|"scans"| node_app
node_trivy -->|"scans"| node_dependencies
node_trivy -->|"reports severity"| node_gate
node_workflow -->|"enforces"| node_gate
node_workflow -->|"uploads findings"| node_sarif
node_gitleaks -->|"provides findings"| node_sarif
node_semgrep -->|"provides findings"| node_sarif
node_trivy -->|"provides findings"| node_sarif
node_sarif -->|"appears in"| node_security_tab
node_syft -->|"produces"| node_sbom
node_workflow -->|"saves SBOM"| node_artifact
node_sbom -->|"stored as"| node_artifact

click node_workflow "https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/.github/workflows/security-scan.yml"
click node_app "https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/app.py"
click node_config "https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/config.py"
click node_dependencies "https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/requirements.txt"
click node_gate "https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/.github/workflows/security-scan.yml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_config,node_dependencies toneBlue
class node_workflow,node_gitleaks,node_semgrep,node_trivy,node_syft,node_gate toneAmber
class node_sarif,node_security_tab,node_sbom,node_artifact toneMint
class node_developer toneIndigo
```

## Components

### Demo application

- [Flask app](https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/app.py): `app.py`
- [Planted credentials](https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/config.py): `config.py`
- [Pinned dependencies](https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/requirements.txt): `requirements.txt`

### Security pipeline

- [Scan workflow](https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/.github/workflows/security-scan.yml): `.github/workflows/security-scan.yml`
- **Gitleaks**
- **Semgrep**
- **Trivy**
- **Syft**
- [Severity gate](https://github.com/praneeth-gande/devsecops-pipeline-demo/blob/main/.github/workflows/security-scan.yml): `.github/workflows/security-scan.yml`

### Findings and inventory

- **SARIF findings**
- **GitHub Security tab**
- **CycloneDX SBOM**
- **Workflow artifact**

### Other components

- **Contributor**

## Connections

- Contributor → Scan workflow: pushes to
- Scan workflow → Gitleaks: runs scan
- Scan workflow → Semgrep: runs scan
- Scan workflow → Trivy: runs scan
- Scan workflow → Syft: generates SBOM
- Gitleaks → Planted credentials: scans
- Semgrep → Flask app: scans
- Trivy → Pinned dependencies: scans
- Trivy → Severity gate: reports severity
- Scan workflow → Severity gate: enforces
- Scan workflow → SARIF findings: uploads findings
- Gitleaks → SARIF findings: provides findings
- Semgrep → SARIF findings: provides findings
- Trivy → SARIF findings: provides findings
- SARIF findings → GitHub Security tab: appears in
- Syft → CycloneDX SBOM: produces
- Scan workflow → Workflow artifact: saves SBOM
- CycloneDX SBOM → Workflow artifact: stored as