Secure Coding Practices para SDLC com IA assistida

@app.get("/download")
def download():
    name = request.args["file"]
    return send_file("/srv/reports/" + name)

BASE = Path("/srv/reports").resolve()
@app.get("/download")
def download():
    name = ReportQuery.model_validate(request.args).file
    target = (BASE / name).resolve()
    if BASE not in target.parents:
        abort(404)
    return send_file(target)

<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-core</artifactId>
  <version>2.14.1</version>
</dependency>

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.apache.logging.log4j</groupId>
      <artifactId>log4j-bom</artifactId>
      <version>2.23.1</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

[Authorize]
public async Task<IActionResult> GetInvoice(Guid id) {
  return Ok(await db.Invoices.FindAsync(id));
}

[Authorize]
public async Task<IActionResult> GetInvoice(Guid id) {
  var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
  var invoice = await db.Invoices.SingleOrDefaultAsync(i => i.Id == id && i.OwnerId == userId);
  return invoice is null ? NotFound() : Ok(invoice);
}

on: pull_request_target
permissions: write-all
steps:
  - run: npm install && npm test
    env:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

on: pull_request
permissions:
  contents: read
steps:
  - run: npm ci --ignore-scripts
  - run: npm test
# publish só em branch protegida + ambiente aprovado

FROM node:latest
WORKDIR /app
COPY . .
RUN npm install
CMD ["npm", "start"]

FROM node:22-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev --ignore-scripts

FROM node:22-alpine
WORKDIR /app
USER node
COPY --from=deps /app/node_modules ./node_modules
COPY --chown=node:node . .
CMD ["node", "server.js"]

actions = ["s3:*"]
resources = ["*"]
cidr_blocks = ["0.0.0.0/0"]

actions   = ["s3:GetObject"]
resources = ["${aws_s3_bucket.data.arn}/reports/*"]
cidr_blocks = [var.office_cidr]
# exceção exige owner, motivo e validade