import os
import stat

for root, _dirs, files in os.walk('/etc'):
    for name in files:
        path = os.path.join(root, name)

#!/usr/bin/env bash
sqlmap \
  -r login-request.txt \
  --risk=2 \
  --level=3 \
  --batch \

#!/usr/bin/env bash
nmap -Pn -sV -O --top-ports 1000 10.10.20.15
nmap -Pn -sC -sV api.internal.example.com
nmap -Pn -sU --top-ports 50 dns.internal.example.com

[sshd]
enabled = true
maxretry = 4
findtime = 10m
bantime = 1h

table inet filter {
  chain input {
    type filter hook input priority 0;
    policy drop;

    ct state established,related accept

Protocol 2
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AllowUsers deploy ops

apiVersion: v1
kind: ServiceAccount
metadata:
  name: metrics-reader
  namespace: production
---

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-ingress
  namespace: production
spec:

- name: Build image
  run: docker build -t app:${{ github.sha }} .

- name: Scan image
  uses: aquasecurity/trivy-action@0.24.0
  with:

FROM ruby:3.3.1-slim AS base

RUN apt-get update \
  && apt-get install -y --no-install-recommends build-essential libpq-dev \
  && rm -rf /var/lib/apt/lists/*

#!/usr/bin/env bash
set -euo pipefail

bundle exec bundler-audit check --update
npm audit --audit-level=high
pip-audit --strict

name: semgrep

on: [pull_request]

jobs:
  scan: