andru-security-sensor

Distributed security sensor + WARDEN intake contract for the Andru platform.

This package is the single source of truth shared by the sensors that scan each service and the central WARDEN intake that aggregates their findings. It provides:

• SensorReport contract (contract.ts) — versioned zod schema imported by both senders and WARDEN.
• SCA — scanDependencies(dir) runs npm audit in a checkout.
• SAST — scanCodeForVulnerabilities(dir) regex static analysis over src/ and app/.
• DAST — probeRuntime(url) checks a live URL's security headers and obvious exposure.
• Signing — HMAC-SHA256 over ${timestamp}.${rawBody} with a 5-minute replay window.
• buildSensorReport() / postReport() — assemble and deliver a signed report.
• security-sensor CLI — for CI sensors.

Architecture

backend resident worker ─┐
frontend CI sensor ──────┼─ signed SensorReport ─▶ WARDEN POST /v1/warden/intake
                         │                          verify → evidence gate → dedupe →
                         │                          incident ledger → Slack

A finding's provenance is attested: the verified HMAC signature + the report's commit vouch that the sensor found it in its own checkout, so WARDEN trusts remote file:line refs it cannot see on its own host (it still rejects unsigned/hallucinated findings).

CLI

npx andru-security-sensor \
  --sensor frontend \
  --dir . \
  --categories dependency,code \
  --probe-url https://platform.andru-ai.com

Env: WARDEN_SENSOR_SECRET (sign), WARDEN_INTAKE_URL (or --intake). Without them, runs dry-run (prints the report, sends nothing). Exits 0 by default — pass --fail-on high|critical to fail CI on matching findings (the platform's security-scan.yml owns PR-blocking).

Library

import { buildSensorReport, postReport, verifySignature, SensorReportSchema } from "andru-security-sensor";

const report = await buildSensorReport({ sensor: "backend", dir: process.cwd(), probeUrls: ["https://hs-andru-test.onrender.com"] });
await postReport(report, { intakeUrl: process.env.WARDEN_INTAKE_URL!, secret: process.env.WARDEN_SENSOR_SECRET! });

Versioning

version == contract v. Any breaking change to SensorReport bumps both. Consumers pin a major range; WARDEN validates v on intake.