Update CI/CD pipeline documentation to include best practices for managing environment variables and secrets. This revision enhances clarity on variable usage, security measures, and integration with GitHub Actions, aiming to improve the overall security and efficiency of the CI/CD process.

Author: fr4iser90

docs/platform_plan/07_feature_backlog.md

@@ -0,0 +1,153 @@
+# SecuLite v2: Feature Backlog
+
+**Version:** 1.0
+**Date:** $(date +%Y-%m-%d)
+**Status:** In Progress
+
+## 1. Introduction and Purpose
+
+This document serves as the initial, comprehensive list of all desired features, functionalities, and capabilities for the SecuLite v2 platform. It aims to capture the full scope of the project's ambitions. This backlog will be used as a basis for prioritization, release planning, and task breakdown during the development lifecycle.
+
+Items listed here will be further refined into user stories or specific tasks, and prioritized (e.g., Must-Have for MVP, Essential, Nice to Have) in subsequent planning phases.
+
+## 2. Feature Prioritization Key (To Be Defined Later)
+
+*(This section will be filled in during prioritization. Example categories:*
+*-   **P0 - Must-Have for MVP**: Critical features without which the product is not viable for its initial release.
+*-   **P1 - Essential**: Important features that significantly enhance the product's value and are planned for early releases.
+*-   **P2 - Nice to Have**: Desirable features that can be implemented in later iterations or if time/resources permit.
+*-   **P3 - Future Consideration**: Ideas for long-term evolution of the platform.)*
+
+## 3. Core Platform & Infrastructure
+
+-   User Authentication (Registration, Login, Logout, Password Reset)
+    -   Password Complexity Rules & Account Lockout (after multiple failed attempts)
+-   Two-Factor/Multi-Factor Authentication (MFA) - (Priority: P0/P1 - Essential for security)
+-   Social Logins (e.g., Google, GitHub) - (Priority: P2/P3 - Future Consideration)
+-   User Authorization & Role-Based Access Control (RBAC - e.g., Admin, Project Owner, Project Member, Auditor) (Specific permissions for each role to be detailed during model design).
+-   Project Management (Create, Read, Update, Delete Projects by authorized users)
+-   Organization/Team Management (Optional. Consider if full multi-tenancy or simpler intra-organization grouping. Full multi-tenancy is a significant effort. Simpler grouping might be P1/P2. MVP to assess criticality).
+-   Comprehensive Audit Logging (User actions, system events, scan activities - e.g., logins, PII access, project CUD, scan CUD, finding status changes, user role changes, critical settings changes).
+-   Robust API Infrastructure (as defined in `03_api_design.md`)
+-   Central Dashboard/Overview Page (Key metrics, recent activity, assigned tasks - e.g., summary stats of findings by severity, recent scan activity, project overview links, assigned tasks/findings).
+-   User Profile Management (View/edit own profile, API key management for users)
+-   System Settings Management (For administrators: e.g., mail server, default configurations)
+-   User-specific Settings/Preferences (e.g., Notification preferences - P1; (Future) Display preferences, timezone - P2)
+
+## 4. Scan Configuration & Execution
+
+-   Scan Configuration Management (Create, Read, Update, Delete configurations).
+    -   Scan configurations to include: name, description, associated project, selected tools & their specific parameter overrides, target(s)/target group(s), schedule, notification settings for the scan.
+    -   Ability to clone/duplicate existing scan configurations.
+-   Tool Definition Management (Define available tools, their parameters, default values, categories)
+-   Target Management (Define assets/targets for scans - e.g., URLs, IP addresses/ranges, code repositories (with branch/commit specifics), Docker images, (Future) cloud resource identifiers).
+    -   Concept of reusable 'Target Groups' that can be associated with multiple scan configurations.
+-   Scheduling Scans (One-time, recurring daily/weekly/monthly at specific times).
+    -   Support for cron-like expressions for advanced scheduling flexibility.
+    -   Clear timezone handling and display for scheduled scans (e.g., schedules stored in UTC, displayed in user's local timezone or a configurable project timezone).
+-   Manual Scan Launch (Trigger a scan on-demand from a configuration)
+-   Asynchronous Scan Execution Engine (Leveraging Celery and Redis as planned)
+-   Real-time Scan Status Tracking (e.g., Queued, Preparing, Initializing Tool X, Running Tool X, Processing Results for Tool X, Aggregating Results, Completed, Failed, Cancelled).
+    -   Display of progress indicators where available (e.g., percentage completion if a tool provides it, or current step in a multi-tool scan).
+-   Detailed Scan History (List of all past and current scans with status and summary)
+-   Scan Cancellation Functionality (For ongoing scans, by authorized users).
+    -   (Policy for handling partial results upon cancellation to be defined - e.g., save available results, or discard. Default to saving available results unless technically infeasible for a tool).
+-   Re-scan Functionality (Easily re-run a previous scan or a scan based on an existing configuration).
+    -   Option to re-scan with the exact original parameters and tool versions (if archived/possible) OR with the latest configuration/tool definitions.
+-   Support for different scan triggers (Manual, Scheduled, API-driven)
+
+## 5. Tool Integration & Management
+
+-   Flexible Framework for integrating diverse security tools (SAST, DAST, SCA, IaC scanners, Secret scanners, etc.).
+    -   Characteristics: e.g., supports a plugin-based architecture, can run tools as CLI commands or Docker containers, provides a common interface for tool invocation and result retrieval.
+-   Development of Wrappers/Adaptors for a core set of initial tools (e.g., Bandit, ESLint/Prettier (for linting as a quality gate), Trivy/Grype for SCA, Gitleaks for secret scanning).
+-   Ability to configure tool-specific parameters per scan configuration.
+-   Standardized parsing and normalization of tool output/results into a common findings format.
+    -   Includes mapping tool-specific severity levels to a standardized internal severity scale (e.g., Critical, High, Medium, Low, Info).
+-   Management interface for viewing available tools and their default configurations.
+    -   Interface should also allow administrators to enable/disable specific tools for use in scan configurations system-wide.
+-   Version tracking for integrated tools (both the wrapper/adaptor version and the underlying tool version).
+-   Mechanism for administrators to check/validate the operational status of integrated tool definitions (e.g., test tool execution with sample inputs, check for correct binary paths or API connectivity if the tool is a service).
+
+## 6. Findings & Vulnerability Management
+
+-   Aggregation of findings from multiple tools for a single scan.
+-   Deduplication of identical findings across different scans or tools (based on configurable criteria - e.g., vulnerability identifier from tool, CWE, file path/URL, line number, code snippet hash).
+-   Detailed Finding View (Description, severity, CWE, CVE, evidence, code snippets, affected file/URL, remediation advice (generic advice linked from CWE/tool, tool-specific advice if available, or custom advice fields), tool source, Timestamps: 'First Seen', 'Last Seen', 'Status Changed Date').
+-   Comprehensive Triage Workflow (e.g., New, Confirmed, False Positive, In Progress, Resolved, Reopened, Accepted Risk/Waiver with justification and expiry).
+-   Assigning findings to specific users for remediation (Future: assign to teams/groups if implemented).
+-   Bulk update capabilities for findings (e.g., change status, assign multiple findings).
+-   Advanced filtering, sorting, and searching of findings (by project, scan, severity, status, tool, date, assignee, etc.).
+-   Severity level management (e.g., Critical, High, Medium, Low, Info - potentially customizable or mapped from tool outputs).
+-   Support for CWE and CVE mapping and linking to external vulnerability databases.
+-   Ability to link findings to external ticketing systems (e.g., JIRA, ServiceNow) or internal knowledge base articles.
+-   (Future) Finding comments, discussion threads, and history/audit trail for each finding.
+-   (Future) False positive marking intelligence/learning.
+-   (Future) Ability to set or automatically calculate (based on severity/policy) due dates for remediating findings, and track SLA compliance.
+
+## 7. Reporting & Analytics
+
+-   Project-level security posture reports (summary of findings, risk scores (e.g., based on count and severity of active findings, potentially factoring in asset criticality if defined in the future), trends).
+    -   Ability to filter these reports by custom time periods, current finding status (e.g., only 'Confirmed', 'New'), or specific scan tags/labels (if implemented).
+-   Scan-specific summary reports (overview of a single scan execution, including scan configuration details used, list of targets scanned, tools run with versions, and a clear summary of findings (counts by severity, new vs. recurring)).
+-   Trend analysis of vulnerabilities over time (e.g., new, resolved, reopened, and recurring findings over time), trends by severity level, (Future) trends for specific CWEs or common vulnerability categories.
+-   Exportable reports in common formats (e.g., PDF, CSV, JSON). (CSV/JSON exports should include comprehensive finding details, allowing for offline analysis, integration with BI tools, or archival. PDF reports would be more formatted summaries).
+-   (Future) Customizable report templates.
+-   (Future) Dashboards for visualizing key metrics (e.g., mean-time-to-remediate (MTTR), vulnerability density). These are analytical dashboards, distinct from the operational 'Central Dashboard/Overview Page' (Section 3). They focus on historical data, trends, and deeper insights into vulnerability management performance (e.g., pie charts for severity distribution, line graphs for vulnerability trends over time, bar charts for most common vulnerabilities/CWEs, heat maps for vulnerable projects/assets).
+-   Report Scheduling and Delivery (Priority: P1/P2): Ability to schedule the generation and automated email delivery of specific reports (e.g., a weekly project summary report to project owners, a monthly compliance overview).
+-   Comparison Reports (Priority: P1/P2): Functionality to generate 'diff' or comparison reports between two selected scans for the same configuration, or between two points in time for a project, highlighting new, resolved, and changed findings.
+-   Executive Summary Reports (Priority: P1/P2): Generation of high-level executive summary reports, focusing on overall risk posture, key trends, and compliance status, suitable for management and non-technical stakeholders.
+
+## 8. Notifications & Alerts (Application-Level)
+
+-   User notifications for scan completion (success/failure).
+    -   Configurable scope: e.g., only for scans initiated by the user, or for all scans on projects they own/are a member of.
+-   Alerts for newly discovered findings.
+    -   Configurable severity threshold (e.g., Critical, High, Medium) for triggering alerts.
+    -   Option for immediate alert delivery or inclusion in a periodic digest (see preferences).
+-   Notifications for findings assigned to a user.
+-   Configurable notification preferences per user:
+    -   Channels: Email, In-app notifications.
+    -   Frequency for digests (e.g., daily, weekly summary of relevant events).
+    -   Ability to opt-in/opt-out of specific notification types (e.g., new finding alerts vs. scan completion).
+-   Notifications for Triage Activity (configurable to manage noise):
+    -   When a finding a user is assigned to (or reported, or is watching) has its status changed (e.g., marked False Positive, Resolved).
+    -   When a comment is added to a finding a user is assigned to or watching.
+-   Notifications for Scheduled Report Generation:
+    -   Confirmation upon successful generation of a scheduled report, with a link to the report.
+-   (Future) Integration with external notification channels like Slack/Teams for application events (distinct from CI/CD notifications).
+
+## 9. Administration & System Management
+
+-   System Health Dashboard for administrators (DB status, Redis status, Celery worker status, disk space, etc.).
+-   User Management Interface (Invite users, manage roles, activate/deactivate accounts).
+-   Tool Management Interface (Add/configure tool definitions, update default parameters).
+-   Background Task Monitoring (View Celery task queues, worker status, task history).
+-   Configuration for external integrations (e.g., JIRA, Slack for app notifications).
+
+## 10. User Experience (UX) & User Interface (UI)
+
+-   Intuitive, clean, and modern web interface built with Vue.js (as planned).
+-   Responsive design for usability across different screen sizes (desktop focus initially).
+-   Clear navigation and information hierarchy.
+-   Accessibility considerations (aiming for WCAG AA where feasible).
+-   User-friendly forms and data displays.
+-   Helpful tooltips, inline help, and onboarding guides for new users.
+
+## 11. Security (Platform Self-Security)
+
+-   Adherence to secure coding practices throughout platform development.
+-   Regular automated security testing of the platform codebase (using its own capabilities where possible - dogfooding).
+-   Protection against common web vulnerabilities (OWASP Top 10 - XSS, SQLi, CSRF, etc.).
+-   Secure handling of secrets and credentials used by the platform itself.
+-   Dependency management and vulnerability scanning for platform components.
+-   (Future) Regular third-party security audits/penetration tests.
+
+## 12. Documentation
+
+-   **User Documentation**: Comprehensive guides on how to use all platform features, aimed at end-users (security engineers, developers).
+-   **Developer Documentation**: Detailed API documentation (e.g., generated from OpenAPI specs), guides for contributing to the platform, and architectural overviews.
+-   **Administration Guide**: Instructions for platform administrators on installation, configuration, maintenance, and troubleshooting.
+-   **Tool Integration Guide**: Documentation for developers on how to integrate new security tools into the SecuLite v2 framework.
+
+---