mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-27 12:18:59 +00:00
Anso
2a4955f56d
* feat: add dedicated Security page and policy-pack foundation Bring vulnerability scanning, scan history, suppressions, Compose risks, secrets, policy packs, and scanner setup into one node-scoped Security command center instead of scattering them across Resources and Settings. - New top-level Security view with Overview, Images, Compose risks, Secrets, Policies, Suppressions, History, and Scanner setup tabs (status masthead + signal rail; controlled tabs with deep-link support). - Backend: GET /security/overview rollup and GET /security/policy-packs static catalog (auth-only, Community). DatabaseService gains an uncapped scan-status count and a node-eligible block-policy count, and getImageScanSummaries now projects secret and misconfig counts. - Reuse existing surfaces: the scan-history sheet, the control-governed suppression and acknowledgement panels, and the scan-detail sheet (now with an initial-tab prop so it opens on the matching finding type). - Extract a shared SeverityBadge (from Resources) and a TrivyManager (from Settings) so both surfaces render identical controls. - Resources "Scan history" now links into the Security page History tab. - Docs for the new Security surface and tests for the new endpoints, helpers, nav wiring, and tabs. * refactor: consolidate scanner and policy management onto the Security page Remove the Settings "Vulnerability Scanning" section now that the Security page covers the same ground, with every option preserved: - Scanner install / update / uninstall / auto-update live on the Scanner setup tab (TrivyManager). - Scan policies, the honor-suppressions toggle, and the replica managed-by-control / demote controls move into a new ScanPolicyManager on the Policies tab (paid; Community sees only the policy-pack catalog). - CVE suppressions and acknowledgements remain on the Suppressions tab. Wiring removed: the registry section and the now-empty Security settings group, the SectionId, the SettingsSectionContent case and the isPaid prop it was the sole consumer of, and SecuritySection itself. The dashboard configuration-status "Vulnerability scanning" row now navigates to the Security page Policies tab. Docs that pointed at "Settings -> Security -> Vulnerability Scanning" are swept to the relevant Security page tabs. * fix: harden Security page scanner refresh, policy-load errors, and secret-only badges Address independent-review findings on the Security page: - Scanner setup now refreshes Trivy state when the active node changes, so the displayed scanner status matches the node TrivyManager's actions target (both follow x-node-id). Previously, switching nodes on the tab left stale state. - ScanPolicyManager surfaces an explicit error state on a failed policy fetch instead of falling through to a false "No scan policies configured". - The shared SeverityBadge and the Images findings column no longer label a scan "clean" when it has secrets or misconfigurations but no CVE severity (highest_severity is derived from vulnerabilities only); they show a "Findings" state and the secret/misconfig counts instead. - The Overview enforcement note points to the Policies tab, not the removed Settings section. - The History tab auto-opens the scan-history sheet only on a deep-link (mount with the History tab active), not on every manual tab selection. Adds tests for the badge secret/misconfig state and the policy-load error state.
84 lines
4.2 KiB
Plaintext
84 lines
4.2 KiB
Plaintext
---
|
|
title: "Security"
|
|
description: "The command center for your fleet's security posture: an overview dashboard, image and Compose findings, secrets, scan history, suppressions, policy packs, and scanner setup, all in one place."
|
|
---
|
|
|
|
Security is a primary surface in Sencho. The **Security** page in the top navigation brings the
|
|
capabilities that power [vulnerability scanning](/features/vulnerability-scanning) into one command
|
|
center, so you can answer "what should I look at first?" without hunting through other pages. It is
|
|
scoped to the active node: the findings and scanner status you see reflect whichever node is selected.
|
|
|
|
The page is organized into tabs.
|
|
|
|
## Overview
|
|
|
|
The overview opens with a status masthead that reads your worst active severity at a glance,
|
|
**Secure**, **At risk**, or **Critical**, alongside the critical and high counts and the time of the
|
|
last successful scan. Below it, a signal rail summarizes the supporting numbers: scanned images,
|
|
fixable findings, secrets, Compose misconfigurations, stale scans, and failed scans. A status strip
|
|
shows scanner health (installed source and version, auto-update) and the active node's deploy
|
|
enforcement posture.
|
|
|
|
If a node does not report an overview (for example an older remote node), the page falls back to a
|
|
clear "overview unavailable" state and the other tabs keep working.
|
|
|
|
## Images
|
|
|
|
Image findings list every scanned image on the active node with its highest severity. Selecting an
|
|
image opens the full scan report, where you can review vulnerabilities, suppress a CVE, and export an
|
|
SBOM.
|
|
|
|
## Compose risks
|
|
|
|
Compose risks surface misconfigurations in your stack definitions rather than image CVEs: privileged
|
|
containers, Docker socket mounts, host networking, broad host bind mounts, missing healthchecks, public
|
|
database ports, containers running as root, unpinned image tags, and missing restart policies. Each
|
|
entry opens its scan report with the specific findings and how to fix them. The [Policy packs](#policy-packs)
|
|
tab explains each category in depth.
|
|
|
|
## Secrets
|
|
|
|
The secrets tab lists images where Trivy detected exposed credentials or keys, and opens straight to
|
|
the secret findings for a scan.
|
|
|
|
## Policy packs
|
|
|
|
Policy packs are curated bundles of security expectations for a deployment posture. Sencho ships five
|
|
defaults:
|
|
|
|
- **Homelab baseline**: gentle defaults for a single-operator homelab.
|
|
- **Production hardening**: sensible hardening for services that face real traffic.
|
|
- **Strict production**: a zero-tolerance posture for critical workloads.
|
|
- **Public edge service**: focused on services exposed to the public internet.
|
|
- **Internal service**: least-privilege defaults for east-west internal services.
|
|
|
|
Each pack lists its rules with the severity, what the rule checks, why it matters, and how to fix it.
|
|
Every rule is marked **warning** or **enforceable**. In Community, packs are advisory: they explain
|
|
what good looks like. Block-on-deploy enforcement is an Admiral capability, configured under
|
|
[scan policies](/features/vulnerability-scanning#scan-policies).
|
|
|
|
## Suppressions
|
|
|
|
CVE suppressions and misconfiguration acknowledgements are managed here, the same controls available
|
|
in Settings. These are governed by the local instance, so this tab is shown when you are on the local
|
|
node; switch to the local node to manage them.
|
|
|
|
## History
|
|
|
|
The History tab opens the scan history sheet, listing completed scans grouped by image with search and
|
|
two-scan comparison. Closing the sheet leaves the tab in place so you can reopen it. The **Scan
|
|
history** button in the [Resources Hub](/features/resources) is a shortcut to the same place.
|
|
|
|
## Scanner setup
|
|
|
|
Scanner setup manages the Trivy binary for the active node: install the managed binary, update it when
|
|
a new release is available, and toggle automatic updates. Trivy is installed independently on each
|
|
node. See [Installing Trivy](/operations/trivy-setup) for the full setup options.
|
|
|
|
## What stays where
|
|
|
|
Resources keeps its per-image severity badges and scan actions, so you can still scan and inspect an
|
|
image from your inventory. Security is the place to review the whole picture; the deeper scanning
|
|
workflow (on-demand scans, scheduled fleet scans, scan policies, SBOM and SARIF export) is documented
|
|
under [Vulnerability scanning](/features/vulnerability-scanning).
|