# Install required libraries
pip install openai>=1.12 python-dotenv>=1.0 GitPython>=3.1 pyyaml>=6.0

# Create directory structure
mkdir -p vuln-scanner/{core,reports,config}
cd vuln-scanner

# Create .env file for API key (NEVER commit this)
echo "OPENAI_API_KEY=your_openai_api_key_here" > .env

"""
AI-Powered Vulnerability Scanner
Detects security vulnerabilities using OpenAI GPT-4 API and LLM analysis.
"""

import os
import json
import time
import hashlib
from typing import Dict, List, Any, Optional, Tuple
from dataclasses import dataclass, asdict
from pathlib import Path
from datetime import datetime
import logging
from concurrent.futures import ThreadPoolExecutor, as_completed

from openai import OpenAI
from dotenv import load_dotenv

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
)
logger = logging.getLogger(__name__)

# Load environment variables
load_dotenv()

# OpenAI API Configuration
OPENAI_API_KEY = os.getenv("OPENAI_API_KEY")
if not OPENAI_API_KEY:
    raise ValueError("OPENAI_API_KEY environment variable not set")

MODEL_ID = "gpt-4-turbo-preview"

# Initialize OpenAI client
client = OpenAI(api_key=OPENAI_API_KEY)

# Vulnerability severity levels (CVSS v3.1 mapping)
SEVERITY_LEVELS = {
    "CRITICAL": {"score": 9.0, "color": "red"},
    "HIGH": {"score": 7.0, "color": "orange"},
    "MEDIUM": {"score": 4.0, "color": "yellow"},
    "LOW": {"score": 0.1, "color": "blue"},
    "INFO": {"score": 0.0, "color": "green"}
}

# CWE (Common Weakness Enumeration) mappings
CWE_MAPPINGS = {
    "SQL Injection": "CWE-89",
    "Command Injection": "CWE-77",
    "XSS": "CWE-79",
    "Path Traversal": "CWE-22",
    "Hardcoded Credentials": "CWE-798",
    "Insecure Deserialization": "CWE-502",
    "SSRF": "CWE-918",
    "XXE": "CWE-611",
    "Insecure Cryptography": "CWE-327",
    "Race Condition": "CWE-362"
}

@dataclass
class Vulnerability:
    """Represents a detected security vulnerability."""
    type: str
    severity: str
    cwe: str
    file_path: str
    line_start: int
    line_end: int
    description: str
    impact: str
    recommendation: str
    code_snippet: str
    cvss_score: float
    detected_at: str

    def to_dict(self) -> Dict[str, Any]:
        """Convert vulnerability to dictionary format."""
        return asdict(self)

    def to_sarif_result(self) -> Dict[str, Any]:
        """Convert to SARIF format for CI/CD integration."""
        return {
            "ruleId": self.cwe,
            "level": self.severity.lower() if self.severity != "CRITICAL" else "error",
            "message": {"text": self.description},
            "locations": [{
                "physicalLocation": {
                    "artifactLocation": {"uri": self.file_path},
                    "region": {
                        "startLine": self.line_start,
                        "endLine": self.line_end,
                        "snippet": {"text": self.code_snippet}
                    }
                }
            }],
            "properties": {
                "severity": self.severity,
                "cvss_score": self.cvss_score,
                "impact": self.impact,
                "recommendation": self.recommendation
            }
        }

class VulnerabilityPrompt:
    """Manages prompts for vulnerability analysis."""

    @staticmethod
    def create_analysis_prompt(
        code: str,
        language: str,
        file_path: str,
        focus_areas: Optional[List[str]] = None
    ) -> str:
        """
        Create comprehensive vulnerability analysis prompt.

        Args:
            code: Source code to analyze
            language: Programming language
            file_path: File path for context
            focus_areas: Specific vulnerability types to focus on

        Returns:
            Formatted prompt for LLM
        """
        focus_section = ""
        if focus_areas:
            focus_section = f"\nPrioritize detection of: {', '.join(focus_areas)}"

        return f"""You are an expert cybersecurity analyst specializing in {language} security.
Perform a comprehensive security analysis of the following code from {file_path}.

DETECTION REQUIREMENTS:
1. Identify ALL security vulnerabilities (not just obvious ones)
2. Consider OWASP Top 10 and CWE common weaknesses
3. Analyze data flow and taint propagation
4. Check for business logic flaws and race conditions
5. Evaluate cryptographic usage and secure configurations{focus_section}

VULNERABILITY CATEGORIES TO CHECK:
- SQL Injection (CWE-89)
- Command Injection (CWE-77, CWE-78)
- Cross-Site Scripting (CWE-79)
- Path Traversal (CWE-22)
- Insecure Deserialization (CWE-502)
- Hardcoded Credentials (CWE-798)
- Weak Cryptography (CWE-327)
- Server-Side Request Forgery (CWE-918)
- XML External Entities (CWE-611)
- Race Conditions (CWE-362)
- Improper Access Control (CWE-284)
- Insecure Random Values (CWE-338)

For EACH vulnerability found, provide a JSON object with this EXACT structure:
{{
  "type": "Vulnerability Type (e.g., SQL Injection)",
  "severity": "CRITICAL|HIGH|MEDIUM|LOW",
  "line_start": line_number_where_vulnerability_starts,
  "line_end": line_number_where_vulnerability_ends,
  "description": "Detailed technical description of the vulnerability",
  "impact": "Specific impact (e.g., 'Allows arbitrary SQL execution, potential data breach')",
  "recommendation": "Specific remediation steps with code examples",
  "code_snippet": "The vulnerable code excerpt"
}}

Return ONLY a JSON array of vulnerability objects. If no vulnerabilities found, return [].
Do NOT include explanatory text outside the JSON array.

CODE TO ANALYZE:
```{language.lower()}
{code}

stages:
  - security

ai_security_scan:
  stage: security
  image: python:3.11-slim

  variables:
    OPENAI_API_KEY: $OPENAI_API_KEY  # Set in GitLab CI/CD variables

  before_script:
    - pip install openai>=1.12 python-dotenv GitPython pyyaml

  script:
    - python vuln-scanner/core/scanner.py
    - |
      CRITICAL_COUNT=$(jq '.vulnerabilities | map(select(.severity == "CRITICAL")) | length' reports/scan_results.json)
      echo "Critical vulnerabilities: $CRITICAL_COUNT"
      if [ "$CRITICAL_COUNT" -gt 0 ]; then
        echo "Build failed: Critical vulnerabilities detected"
        exit 1
      fi

  artifacts:
    when: always
    paths:
      - reports/
    reports:
      sast: reports/scan_results.sarif
    expire_in: 30 days

  allow_failure: false

class LanguageSpecificScanner:
    """Language-specific vulnerability detection strategies."""

    LANGUAGE_PATTERNS = {
        "Python": {
            "critical": [
                "eval\\(", "exec\\(", "pickle\\.loads\\(",
                "__import__\\(", "subprocess\\.call\\(",
                "os\\.system\\("
            ],
            "high": [
                "sqlite3\\.execute\\(.*%", "cursor\\.execute\\(.*format",
                "yaml\\.load\\((?!.*Loader=)", "input\\(.*eval"
            ],
            "frameworks": ["Django", "Flask", "FastAPI"]
        },
        "JavaScript": {
            "critical": [
                "eval\\(", "Function\\(", "setTimeout\\(.*String",
                "setInterval\\(.*String", "innerHTML\\s*="
            ],
            "high": [
                "dangerouslySetInnerHTML", "v-html", "execSync\\(",
                "document\\.write\\("
            ],
            "frameworks": ["React", "Vue", "Express", "Next.js"]
        },
        "PHP": {
            "critical": [
                "eval\\(", "system\\(", "exec\\(", "passthru\\(",
                "shell_exec\\(", "unserialize\\("
            ],
            "high": [
                "mysqli_query\\(.*\\$", "include\\s+\\$",
                "require\\s+\\$", "file_get_contents\\(\\$"
            ],
            "frameworks": ["Laravel", "Symfony", "WordPress"]
        }
    }

    @classmethod
    def get_focus_areas(cls, language: str) -> List[str]:
        """Get language-specific vulnerability focus areas."""
        patterns = cls.LANGUAGE_PATTERNS.get(language, {})
        focus = []

        if "critical" in patterns:
            focus.append("Code Execution Vulnerabilities")
        if "frameworks" in patterns:
            focus.append(f"{language} Framework Security")

        return focus

from tqdm import tqdm

class BatchScanner:
    """Batch scanning with progress tracking and retry logic."""

    def __init__(self, scanner: VulnerabilityScanner):
        self.scanner = scanner

    def scan_repository(
        self,
        repo_path: Path,
        batch_size: int = 10,
        max_retries: int = 3
    ) -> List[Vulnerability]:
        """
        Scan entire repository in batches with progress tracking.

        Args:
            repo_path: Repository root path
            batch_size: Number of files to process per batch
            max_retries: Maximum retry attempts for failed files

        Returns:
            All detected vulnerabilities
        """
        # Discover all files
        files = list(repo_path.rglob("*.py")) + list(repo_path.rglob("*.js"))

        all_vulnerabilities = []
        failed_files = []

        # Process in batches with progress bar
        with tqdm(total=len(files), desc="Scanning files") as pbar:
            for i in range(0, len(files), batch_size):
                batch = files[i:i + batch_size]

                for file_path in batch:
                    retries = 0
                    success = False

                    while retries < max_retries and not success:
                        try:
                            vulns = self.scanner.scan_file(file_path)
                            all_vulnerabilities.extend(vulns)
                            success = True
                        except Exception as e:
                            retries += 1
                            logger.warning(
                                f"Retry {retries}/{max_retries} for {file_path}: {e}"
                            )
                            time.sleep(2 ** retries)  # Exponential backoff

                    if not success:
                        failed_files.append(str(file_path))

                    pbar.update(1)

                # Progress checkpoint
                pbar.set_postfix({
                    "vulnerabilities": len(all_vulnerabilities),
                    "failed": len(failed_files)
                })

        if failed_files:
            logger.error(f"Failed to scan {len(failed_files)} files: {failed_files}")

        return all_vulnerabilities

import subprocess
import xml.etree.ElementTree as ET

class HybridSecurityScanner:
    """
    Combines AI-powered scanning with traditional SAST tools.
    Correlates findings from multiple sources for comprehensive coverage.
    """

    def __init__(self, ai_scanner: VulnerabilityScanner):
        self.ai_scanner = ai_scanner

    def run_semgrep(self, target_path: Path) -> List[Dict[str, Any]]:
        """
        Run Semgrep SAST scanner.

        Requires: pip install semgrep
        """
        try:
            result = subprocess.run(
                ["semgrep", "--config=auto", "--json", str(target_path)],
                capture_output=True,
                text=True,
                timeout=300
            )

            if result.returncode == 0:
                data = json.loads(result.stdout)
                return data.get("results", [])
            else:
                logger.error(f"Semgrep failed: {result.stderr}")
                return []

        except FileNotFoundError:
            logger.warning("Semgrep not installed, skipping")
            return []
        except Exception as e:
            logger.error(f"Semgrep error: {e}")
            return []

    def run_bandit(self, target_path: Path) -> List[Dict[str, Any]]:
        """
        Run Bandit Python security scanner.

        Requires: pip install bandit
        """
        try:
            result = subprocess.run(
                ["bandit", "-r", str(target_path), "-f", "json"],
                capture_output=True,
                text=True,
                timeout=300
            )

            data = json.loads(result.stdout)
            return data.get("results", [])

        except FileNotFoundError:
            logger.warning("Bandit not installed, skipping")
            return []
        except Exception as e:
            logger.error(f"Bandit error: {e}")
            return []

    def correlate_findings(
        self,
        ai_vulns: List[Vulnerability],
        semgrep_results: List[Dict],
        bandit_results: List[Dict]
    ) -> Dict[str, Any]:
        """
        Correlate findings from multiple tools to reduce false positives.

        Vulnerabilities detected by multiple tools are marked as high confidence.
        """
        # Build correlation index by file and line number
        correlation_map = {}

        # Add AI findings
        for vuln in ai_vulns:
            key = f"{vuln.file_path}:{vuln.line_start}"
            if key not in correlation_map:
                correlation_map[key] = {
                    "sources": [],
                    "vulnerability": vuln,
                    "confidence": "medium"
                }
            correlation_map[key]["sources"].append("AI")

        # Add Semgrep findings
        for finding in semgrep_results:
            file_path = finding.get("path", "")
            line = finding.get("start", {}).get("line", 0)
            key = f"{file_path}:{line}"

            if key in correlation_map:
                correlation_map[key]["sources"].append("Semgrep")
            else:
                # New finding from Semgrep only
                correlation_map[key] = {
                    "sources": ["Semgrep"],
                    "vulnerability": finding,
                    "confidence": "low"
                }

        # Determine confidence levels
        high_confidence = []
        medium_confidence = []
        low_confidence = []

        for key, data in correlation_map.items():
            num_sources = len(set(data["sources"]))

            if num_sources >= 2:
                data["confidence"] = "high"
                high_confidence.append(data)
            elif "AI" in data["sources"]:
                data["confidence"] = "medium"
                medium_confidence.append(data)
            else:
                data["confidence"] = "low"
                low_confidence.append(data)

        return {
            "high_confidence": high_confidence,
            "medium_confidence": medium_confidence,
            "low_confidence": low_confidence,
            "total": len(correlation_map)
        }

    def comprehensive_scan(self, target_path: Path) -> Dict[str, Any]:
        """Run comprehensive scan with all available tools."""
        logger.info("Starting comprehensive security scan")

        # Run AI scan
        logger.info("Running AI-powered scan")
        ai_vulns = self.ai_scanner.scan_directory(target_path)

        # Run traditional tools
        logger.info("Running Semgrep")
        semgrep_results = self.run_semgrep(target_path)

        logger.info("Running Bandit")
        bandit_results = self.run_bandit(target_path)

        # Correlate findings
        logger.info("Correlating findings from all tools")
        correlated = self.correlate_findings(ai_vulns, semgrep_results, bandit_results)

        return {
            "ai_vulnerabilities": ai_vulns,
            "semgrep_results": semgrep_results,
            "bandit_results": bandit_results,
            "correlated_findings": correlated,
            "summary": {
                "total_ai": len(ai_vulns),
                "total_semgrep": len(semgrep_results),
                "total_bandit": len(bandit_results),
                "high_confidence": len(correlated["high_confidence"]),
                "medium_confidence": len(correlated["medium_confidence"]),
                "low_confidence": len(correlated["low_confidence"])
            }
        }

class CostOptimizer:
    """Strategies for optimizing OpenAI API costs during scanning."""

    @staticmethod
    def chunk_large_files(code: str, max_chunk_size: int = 10000) -> List[str]:
        """
        Split large files into analyzable chunks.

        Args:
            code: Source code
            max_chunk_size: Maximum characters per chunk

        Returns:
            List of code chunks
        """
        if len(code) <= max_chunk_size:
            return [code]

        # Split by functions/classes (language-aware splitting)
        chunks = []
        lines = code.split('\n')
        current_chunk = []
        current_size = 0

        for line in lines:
            line_size = len(line) + 1  # +1 for newline

            if current_size + line_size > max_chunk_size and current_chunk:
                chunks.append('\n'.join(current_chunk))
                current_chunk = [line]
                current_size = line_size
            else:
                current_chunk.append(line)
                current_size += line_size

        if current_chunk:
            chunks.append('\n'.join(current_chunk))

        return chunks

    @staticmethod
    def prioritize_risky_files(files: List[Path]) -> List[Path]:
        """
        Prioritize scanning files most likely to contain vulnerabilities.

        High-risk indicators:
        - Authentication/authorization code
        - Database queries
        - File operations
        - Network requests
        - User input handling
        """
        risk_keywords = {
            "high": ["auth", "login", "password", "token", "session", "sql", "query", "database"],
            "medium": ["upload", "download", "file", "request", "api", "endpoint"],
            "low": ["util", "helper", "constant", "config"]
        }

        def calculate_risk(file_path: Path) -> int:
            """Calculate risk score for file."""
            score = 0
            file_name_lower = file_path.name.lower()

            for keyword in risk_keywords["high"]:
                if keyword in file_name_lower:
                    score += 10

            for keyword in risk_keywords["medium"]:
                if keyword in file_name_lower:
                    score += 5

            for keyword in risk_keywords["low"]:
                if keyword in file_name_lower:
                    score -= 2

            return score

        # Sort by risk score (descending)
        return sorted(files, key=calculate_risk, reverse=True)

    @staticmethod
    def estimate_cost(
        num_files: int,
        avg_file_size: int,
        price_per_1k_tokens: float = 0.0001
    ) -> float:
        """
        Estimate scanning cost.

        Args:
            num_files: Number of files to scan
            avg_file_size: Average file size in characters
            price_per_1k_tokens: Price per 1000 tokens (GPT-4-Turbo: ~$0.01 input + $0.03 output)

        Returns:
            Estimated cost in USD
        """
        # Rough estimation: 1 token ≈ 4 characters
        tokens_per_file = (avg_file_size / 4) * 2  # x2 for prompt + response
        total_tokens = num_files * tokens_per_file

        cost = (total_tokens / 1000) * price_per_1k_tokens
        return round(cost, 4)

# Error: "Invalid API key" or 401 Unauthorized

# Solution 1: Verify API key is set correctly
import os
print(f"API Key set: {bool(os.getenv('OPENAI_API_KEY'))}")
print(f"API Key prefix: {os.getenv('OPENAI_API_KEY', '')[:10]}...")

# Solution 2: Check environment variable loading
from dotenv import load_dotenv
load_dotenv(verbose=True)  # Prints loaded variables

# Solution 3: Verify API key permissions in OpenAI dashboard
# Log in to platform.openai.com -> API Keys -> Check key status and usage limits

# Error: "JSONDecodeError: Expecting value"

# Solution 1: Handle markdown-formatted responses
def extract_json_from_response(content: str) -> str:
    """Extract JSON from markdown code blocks."""
    if "```json" in content:
        content = content.split("```json")[1].split("```")[0].strip()
    elif "```" in content:
        content = content.split("```")[1].split("```")[0].strip()
    return content

# Solution 2: Add retry logic with stricter prompts
def analyze_with_retry(prompt: str, max_retries: int = 3) -> List[Vulnerability]:
    """Retry analysis with increasingly strict JSON formatting requirements."""
    for attempt in range(max_retries):
        if attempt > 0:
            prompt += f"\n\nIMPORTANT: Return ONLY valid JSON array. Attempt {attempt + 1}/{max_retries}."

        response = client.chat.completions.create(...)

        try:
            return parse_vulnerabilities(response.choices[0].message.content)
        except json.JSONDecodeError as e:
            logger.warning(f"Attempt {attempt + 1} failed: {e}")
            if attempt == max_retries - 1:
                raise

    return []

# Solution 1: Implement confidence scoring
def calculate_confidence(vuln: Vulnerability, code_context: str) -> float:
    """
    Calculate confidence score (0.0-1.0) for vulnerability.

    High confidence indicators:
    - Severity is CRITICAL or HIGH
    - Vulnerability type has known CWE mapping
    - Code snippet contains dangerous functions (eval, exec, etc.)
    - Dataflow analysis confirms taint propagation
    """
    confidence = 0.5  # Base confidence

    # Severity boost
    if vuln.severity == "CRITICAL":
        confidence += 0.3
    elif vuln.severity == "HIGH":
        confidence += 0.2

    # Known dangerous patterns boost
    dangerous_patterns = ["eval(", "exec(", "system(", "unserialize("]
    if any(pattern in vuln.code_snippet for pattern in dangerous_patterns):
        confidence += 0.2

    # CWE validation boost
    if vuln.cwe in CWE_MAPPINGS.values():
        confidence += 0.1

    return min(confidence, 1.0)

# Solution 2: Use hybrid validation
hybrid_scanner = HybridSecurityScanner(ai_scanner)
results = hybrid_scanner.comprehensive_scan(Path("."))

# Only report high-confidence findings
high_confidence_vulns = results["correlated_findings"]["high_confidence"]

# Solution 1: Increase parallelization
scanner = VulnerabilityScanner(
    max_workers=10,  # Increase from default 5
    rate_limit_delay=0.05  # Reduce delay if no rate limiting issues
)

# Solution 2: Implement caching for unchanged files
import hashlib

class CachedScanner:
    """Scanner with file-level caching based on content hashes."""

    def __init__(self, scanner: VulnerabilityScanner, cache_file: str = ".scan_cache.json"):
        self.scanner = scanner
        self.cache_file = cache_file
        self.cache = self._load_cache()

    def _load_cache(self) -> Dict[str, Any]:
        """Load scan cache from disk."""
        if os.path.exists(self.cache_file):
            with open(self.cache_file, 'r') as f:
                return json.load(f)
        return {}

    def _save_cache(self):
        """Save scan cache to disk."""
        with open(self.cache_file, 'w') as f:
            json.dump(self.cache, f, indent=2)

    def _file_hash(self, file_path: Path) -> str:
        """Calculate SHA-256 hash of file content."""
        hasher = hashlib.sha256()
        with open(file_path, 'rb') as f:
            hasher.update(f.read())
        return hasher.hexdigest()

    def scan_file(self, file_path: Path) -> List[Vulnerability]:
        """Scan file with caching."""
        file_hash = self._file_hash(file_path)
        cache_key = f"{file_path}:{file_hash}"

        # Check cache
        if cache_key in self.cache:
            logger.info(f"Cache hit for {file_path}")
            return [Vulnerability(**v) for v in self.cache[cache_key]]

        # Scan file
        vulnerabilities = self.scanner.scan_file(file_path)

        # Update cache
        self.cache[cache_key] = [v.to_dict() for v in vulnerabilities]
        self._save_cache()

        return vulnerabilities

# Solution: Implement exponential backoff
import time
from openai import RateLimitError

def analyze_with_backoff(prompt: str, max_retries: int = 5) -> str:
    """Make API call with exponential backoff on rate limits."""
    for attempt in range(max_retries):
        try:
            response = client.chat.completions.create(
                model=MODEL_ID,
                messages=[{"role": "user", "content": prompt}],
                max_tokens=4096,
                temperature=0.1
            )
            return response.choices[0].message.content

        except RateLimitError as e:
            if attempt == max_retries - 1:
                raise

            # Exponential backoff: 2^attempt seconds
            wait_time = 2 ** attempt
            logger.warning(f"Rate limited. Waiting {wait_time}s before retry {attempt + 1}/{max_retries}")
            time.sleep(wait_time)

    raise Exception("Max retries exceeded")

# NEVER log or store analyzed code containing secrets
class SecureScanner(VulnerabilityScanner):
    """Scanner with security best practices."""

    def analyze_code(self, code: str, **kwargs) -> List[Vulnerability]:
        """Override to sanitize logs."""
        # Redact potential secrets before logging
        sanitized_code = self._sanitize_code(code)
        logger.info(f"Analyzing code ({len(code)} bytes)")

        # NEVER log full code content
        # logger.debug(f"Code: {code}")  # DANGEROUS!

        return super().analyze_code(code, **kwargs)

    def _sanitize_code(self, code: str) -> str:
        """Redact potential secrets from code for logging."""
        import re

        # Redact API keys, tokens, passwords
        patterns = [
            (r'(api_key|apikey|token|password|secret)\s*=\s*["\'][^"\']+["\']', r'\1=***'),
            (r'Bearer\s+[A-Za-z0-9\-._~+/]+=*', 'Bearer ***'),
            (r'[A-Za-z0-9]{32,}', '***')  # Long alphanumeric strings
        ]

        for pattern, replacement in patterns:
            code = re.sub(pattern, replacement, code, flags=re.IGNORECASE)

        return code

# Use environment variables for all secrets
# NEVER hardcode API keys
# Store scan results securely (encrypt at rest)
# Implement access controls for scan reports
# Audit all scanner usage

# Implement metrics and alerting
class MonitoredScanner(VulnerabilityScanner):
    """Scanner with built-in monitoring and metrics."""

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self.metrics = {
            "scan_duration": [],
            "api_latency": [],
            "error_rate": 0.0
        }

    def scan_directory(self, *args, **kwargs) -> List[Vulnerability]:
        """Scan with timing metrics."""
        start_time = time.time()

        try:
            vulnerabilities = super().scan_directory(*args, **kwargs)
            duration = time.time() - start_time

            self.metrics["scan_duration"].append(duration)

            # Alert on slow scans
            if duration > 300:  # 5 minutes
                logger.warning(f"Slow scan detected: {duration:.2f}s")

            return vulnerabilities

        except Exception as e:
            self.metrics["error_rate"] = (
                self.scan_stats["errors"] / max(self.scan_stats["api_calls"], 1)
            )

            # Alert on high error rates
            if self.metrics["error_rate"] > 0.1:  # >10% errors
                logger.error(f"High error rate: {self.metrics['error_rate']:.1%}")

            raise

    def export_metrics(self) -> Dict[str, Any]:
        """Export metrics for monitoring systems (Prometheus, CloudWatch, etc.)."""
        return {
            "avg_scan_duration": sum(self.metrics["scan_duration"]) / len(self.metrics["scan_duration"]) if self.metrics["scan_duration"] else 0,
            "error_rate": self.metrics["error_rate"],
            **self.scan_stats
        }

# test_scanner.py - Basic integration tests

import unittest
from pathlib import Path
from core.scanner import VulnerabilityScanner

class TestVulnerabilityScanner(unittest.TestCase):

    @classmethod
    def setUpClass(cls):
        cls.scanner = VulnerabilityScanner()

    def test_sql_injection_detection(self):
        """Test scanner detects SQL injection."""
        vulnerable_code = '''
def get_user(username):
    query = f"SELECT * FROM users WHERE name = '{username}'"
    cursor.execute(query)
        '''

        vulns = self.scanner.analyze_code(
            code=vulnerable_code,
            language="Python",
            file_path="test.py"
        )

        # Should detect SQL injection
        self.assertTrue(any(v.type == "SQL Injection" for v in vulns))
        self.assertTrue(any(v.severity in ["CRITICAL", "HIGH"] for v in vulns))

    def test_safe_code_no_false_positives(self):
        """Test scanner doesn't flag secure code."""
        safe_code = '''
def get_user(username):
    query = "SELECT * FROM users WHERE name = ?"
    cursor.execute(query, (username,))
        '''

        vulns = self.scanner.analyze_code(
            code=safe_code,
            language="Python",
            file_path="test.py"
        )

        # Should not detect SQL injection in parameterized query
        sql_vulns = [v for v in vulns if v.type == "SQL Injection"]
        self.assertEqual(len(sql_vulns), 0)

    def test_xss_detection(self):
        """Test scanner detects XSS vulnerabilities."""
        vulnerable_code = '''
function displayUser(name) {
    document.getElementById('output').innerHTML = name;
}
        '''

        vulns = self.scanner.analyze_code(
            code=vulnerable_code,
            language="JavaScript",
            file_path="test.js"
        )

        # Should detect XSS
        self.assertTrue(any("XSS" in v.type or "Cross-Site" in v.type for v in vulns))

if __name__ == '__main__':
    unittest.main()