[JD2112]

1. Vulnerability & Sanitization Audit Findings

Category	Target / Checks	Findings & Actions Taken	Status
API Keys & Secrets	AWS, GCP, GitHub/GitLab tokens, Slack, OpenAI, HuggingFace, Private Keys (BEGIN ... PRIVATE KEY)	0 detected. Scanned all files across the repository; no credentials or private keys present.	CLEAN
Local Paths & Host Leaks	Hardcoded user paths (/Users/username, /home/username, /data/username)	Remediated. Cleaned remaining host-specific paths: • conf/fraka.config: Replaced ... with dorado • conf/human.config: Sanitized snpeff_cache • conf/eukaryote.config: Sanitized default reference paths • samplesheet.csv: Replaced ... with generic /path/to/reads.pod5	CLEAN
PHI / PII Data	Patient names, MRNs, NHS numbers, SSNs, personal clinical metadata	0 detected. Production code and test assets use anonymized synthetic IDs.	CLEAN
Git Hygiene & Large Binaries	Files $\ge 25$ MB, .env files, .key/.pem files, temporary Nextflow execution work	Protected. Updated .gitignore with strict blocks for credentials (*.key, *.pem, *.p12, *.pfx, id_rsa*, .env*, credentials*). No files exceed GitHub limits.	CLEAN

---

2. New Security Audit Tooling

We built a modular, reusable security scanner tailored for this repository:

1. bin/security_audit.py:

   • Standalone Python 3 standard library scanner (no external dependencies required).
   • Scans candidate files (honoring .gitignore) against an extensible pattern catalog covering:
     • Cloud & platform secrets (SEC-001 through SEC-009)
     • Infrastructure & path leakage (INF-001, INF-002)
     • Clinical PHI / PII patterns (PHI-001, PHI-002)
     • Dangerous code constructs (COD-001)
     • Prohibited file extensions & oversized files
   • Supports --staged-only, --strict, and --json reporting flags.

2. security_check.sh:

   • Convenient root-level executable runner.