security: fail-closed crypto, audit integrity error, CI hardening

[poojakira]

What was wrong

• decrypt() silently swallowed InvalidTag or did not exist
• verify_audit_log() returned False instead of raising on critical failures
• CI actions used floating @v tags
• No evidence_policy.json

What was changed

• encryption.py: decrypt() re-raises InvalidTag, never returns default
• audit.py: AuditIntegrityError raised on broken chain
• CI: all action SHAs pinned, pip-audit added
• evidence_policy.json added

Tests added

• test_decrypt_raises_on_tampered_ciphertext
• test_audit_log_verify_detects_corruption

Remaining risks

• AWS KMS envelope encryption not yet implemented
• OIDC authentication not yet implemented
• See SECURITY_AUDIT.md for full list

Summary by CodeRabbit

• Security Enhancements

  • Strengthened JWT validation with expiration, issuer, audience, and activation-time checks.
  • Added authenticated AES-256-GCM encryption with strict key validation and fail-closed error handling.
  • Improved audit-log integrity verification and corruption detection.
  • Added dependency vulnerability scanning and pinned CI security actions.

• Documentation

  • Added a comprehensive security audit report.
  • Clarified encryption-key storage practices and planned integrations.
  • Added an evidence metadata template for security and performance metrics.

• Tests

  • Added regression coverage for token expiration, encrypted data tampering, and audit-log corruption.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b903756d-a5ee-4eb8-8819-39954c2f5ff2

📥 Commits

Reviewing files that changed from the base of the PR and between 075569d and 1714fd9.

📒 Files selected for processing (8)

• .github/workflows/ci.yml
• README.md
• SECURITY_AUDIT.md
• evidence_policy.json
• src/pulsenet/api/auth.py
• src/pulsenet/security/audit.py
• src/pulsenet/security/encryption.py
• tests/test_security.py

---

📝 Walkthrough

Walkthrough

The change strengthens JWT claim validation, AES-GCM encryption, audit-log verification, CI supply-chain controls, security documentation, and regression coverage.

Changes

Security hardening

Layer / File(s)	Summary
JWT claim issuance and validation src/pulsenet/api/auth.py, tests/test_security.py	JWT tokens now include and validate issuer, audience, not-before, expiration, and unique identifier claims. Expired-token coverage was added.
AES-GCM and decryption failure handling src/pulsenet/security/encryption.py, tests/test_security.py	AES-256-GCM primitives were added. Decryption failures now propagate instead of returning 0.0. Tampering and invalid-key tests were added.
Fail-closed audit-log verification src/pulsenet/security/audit.py, tests/test_security.py	Audit verification now raises AuditIntegrityError for integrity and file errors. Hash-chain corruption tests were added.
CI controls and security evidence .github/workflows/ci.yml, README.md, SECURITY_AUDIT.md, evidence_policy.json	CI actions are pinned, pip-audit runs before coverage upload, and security findings, evidence metadata, and key-storage claims are documented.

Estimated code review effort: 4 (Complex) | ~45 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/security-hardening-v1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}