Public Access
77 lines
2.7 KiB
Markdown
77 lines
2.7 KiB
Markdown
# Charybdis - TODO List
|
|
|
|
**Last Updated**: 2026-06-09
|
|
**Status**: Phase 0 done. Phase 1 (Security Core) in progress — ingestion + reconciliation shipped; assessment & gates remaining.
|
|
|
|
> Aligned with [VISION.md](VISION.md) roadmap.
|
|
|
|
---
|
|
|
|
## Phase 1: Security Core (In Progress)
|
|
|
|
> **Goal**: Native vulnerability management and scan ingestion. Replace DefectDojo for finding lifecycle management.
|
|
> **Architecture**: Core features (reconciliation, dedup, dry-run) in `src/`. Parsers extensible via `ScannerParser` trait. Plugins contribute parsers via `contributed_parsers()`.
|
|
|
|
### Done
|
|
|
|
- [x] `Finding` entity kind (proto + storage)
|
|
- [x] `IngestionService` gRPC endpoint (`ImportScan` + `DryRunScan`)
|
|
- [x] `ScannerParser` trait + `ParserRegistry`
|
|
- [x] SARIF parser (built-in)
|
|
- [x] Fingerprint-based deduplication (scanner-provided when present, sha256 fallback)
|
|
- [x] Reconciliation engine (new / unchanged / resolved / reopened buckets, scoped to `(component, lifecycle)`)
|
|
|
|
### Remaining
|
|
|
|
- [ ] CycloneDX VEX parser (vulnerability data from SBOMs)
|
|
- [ ] `Plugin::contributed_parsers()` default impl on base trait
|
|
- [ ] Publish events: `FindingCreated`, `FindingResolved`, `FindingReopened` (for downstream plugins)
|
|
- [ ] Assessment workflow (triage, accept risk, remediate — the `ACCEPTED` / `FALSE_POSITIVE` state values exist but no API sets them)
|
|
- [ ] Rules engine for auto-assessment
|
|
- [ ] Security gates (severity thresholds per product)
|
|
- [ ] License tracking and policy engine
|
|
|
|
---
|
|
|
|
## Phase 2: Compliance & Integrations
|
|
|
|
> **Goal**: Compliance frameworks and integration plugins.
|
|
|
|
- [ ] Compliance framework mappings (NIS2, SOC2, DORA)
|
|
- [ ] VEX document support (CSAF, OpenVEX)
|
|
- [ ] Export/reporting (PDF, Excel)
|
|
- [ ] Notification plugins (Slack, Teams, email)
|
|
- [ ] Issue tracker plugins (Jira, GitHub, GitLab)
|
|
- [ ] Redis event bus backend (production)
|
|
|
|
---
|
|
|
|
## Phase 3: Scaffolder & Ecosystem
|
|
|
|
> **Goal**: Service scaffolding and community growth.
|
|
|
|
- [ ] Service scaffolder (Git-native templates, not Nunjucks)
|
|
- [ ] Event-driven provisioning on scaffold
|
|
- [ ] Plugin SDK documentation
|
|
- [ ] Helm chart & 1-click deploy
|
|
- [ ] Community plugin registry
|
|
|
|
---
|
|
|
|
## Infrastructure & Quality
|
|
|
|
- [ ] Performance benchmarks (criterion)
|
|
- [ ] Dependency-Track plugin implementation (follow DefectDojo pattern)
|
|
|
|
---
|
|
|
|
## Non-Goals (per VISION.md)
|
|
|
|
These will **not** be implemented:
|
|
|
|
- ~~REST API~~ — gRPC only. Teams can add REST via grpc-gateway or Envoy.
|
|
- ~~GraphQL API~~ — Same. gRPC is the single API surface.
|
|
- ~~Hot-swappable plugins~~ — Plugins are compile-time integrated for type safety.
|
|
- ~~Scanner execution~~ — Charybdis ingests results, it doesn't run scanners.
|
|
- ~~SIEM features~~ — Not an incident response tool.
|