# zahardlazy/securepipe-demo architecture

> Architecture diagram of the GitHub repository zahardlazy/securepipe-demo, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-17). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/zahardlazy/securepipe-demo
- Repository: https://github.com/zahardlazy/securepipe-demo

## Overview

SecurePipe Demo combines a deliberately vulnerable Flask sample with a security-focused build-chain demonstration. Its visible runtime workflow is an HTTP client requesting the user endpoint, which initializes/queries a local SQLite database and returns a user or 404. The repository also contains workflow, quality-gate, provenance, and infrastructure areas; their detailed wiring is not shown in the supplied excerpts, so those relationships are left unverified rather than inferred.

Main entry points: [`.github/workflows`](https://github.com/zahardlazy/securepipe-demo/tree/main/.github/workflows) (GitHub workflows), [`app/app.py`](https://github.com/zahardlazy/securepipe-demo/blob/main/app/app.py) (User endpoint), [`.github/scripts`](https://github.com/zahardlazy/securepipe-demo/tree/main/.github/scripts) (Quality gate), [`infra`](https://github.com/zahardlazy/securepipe-demo/tree/main/infra) (Terraform infrastructure)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Demo app"]
  node_flask["Flask app<br/>[app.py]"]
  node_user_route["User endpoint<br/>[app.py]"]
  node_users_db[("SQLite users<br/>[app.py]")]
end

subgraph group_pipeline["Secure build chain"]
  node_actions["GitHub workflows<br/>[workflows]"]
  node_quality_gate["Quality gate<br/>[scripts]"]
  node_provenance["Provenance<br/>[scripts]"]
  node_image["Image build<br/>[workflows]"]
end

subgraph group_operations["Deployment"]
  node_deployment["Deployment<br/>[workflows]"]
  node_infra["Terraform infrastructure"]
end

node_client(("HTTP client"))

node_client -->|"requests"| node_user_route
node_user_route -->|"queries and seeds"| node_users_db
node_actions -.->|"runs"| node_quality_gate
node_actions -.->|"generates"| node_provenance
node_actions -.->|"builds"| node_image
node_actions -.->|"deploys"| node_deployment
node_deployment -.->|"uses"| node_infra

click node_flask "https://github.com/zahardlazy/securepipe-demo/blob/main/app/app.py"
click node_user_route "https://github.com/zahardlazy/securepipe-demo/blob/main/app/app.py"
click node_users_db "https://github.com/zahardlazy/securepipe-demo/blob/main/app/app.py"
click node_actions "https://github.com/zahardlazy/securepipe-demo/tree/main/.github/workflows"
click node_quality_gate "https://github.com/zahardlazy/securepipe-demo/tree/main/.github/scripts"
click node_provenance "https://github.com/zahardlazy/securepipe-demo/tree/main/.github/scripts"
click node_image "https://github.com/zahardlazy/securepipe-demo/tree/main/.github/workflows"
click node_deployment "https://github.com/zahardlazy/securepipe-demo/tree/main/.github/workflows"
click node_infra "https://github.com/zahardlazy/securepipe-demo/tree/main/infra"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_flask,node_user_route,node_users_db,node_client toneBlue
class node_actions,node_quality_gate,node_provenance,node_image toneAmber
class node_deployment,node_infra toneMint
```

## Components

### Demo app

- [Flask app](https://github.com/zahardlazy/securepipe-demo/blob/main/app/app.py): `app/app.py`
- [User endpoint](https://github.com/zahardlazy/securepipe-demo/blob/main/app/app.py): `app/app.py`
- [SQLite users](https://github.com/zahardlazy/securepipe-demo/blob/main/app/app.py): `app/app.py`

### Secure build chain

- [GitHub workflows](https://github.com/zahardlazy/securepipe-demo/tree/main/.github/workflows): `.github/workflows`
- [Quality gate](https://github.com/zahardlazy/securepipe-demo/tree/main/.github/scripts): `.github/scripts`
- [Provenance](https://github.com/zahardlazy/securepipe-demo/tree/main/.github/scripts): `.github/scripts`
- [Image build](https://github.com/zahardlazy/securepipe-demo/tree/main/.github/workflows): `.github/workflows`

### Deployment

- [Deployment](https://github.com/zahardlazy/securepipe-demo/tree/main/.github/workflows): `.github/workflows`
- [Terraform infrastructure](https://github.com/zahardlazy/securepipe-demo/tree/main/infra): `infra`

### Other components

- **HTTP client**

## Connections

- HTTP client → User endpoint: requests (evidence: `app/app.py`)
- User endpoint → SQLite users: queries and seeds (evidence: `app/app.py`)
- GitHub workflows → Quality gate: runs
- GitHub workflows → Provenance: generates
- GitHub workflows → Image build: builds
- GitHub workflows → Deployment: deploys
- Deployment → Terraform infrastructure: uses