.env.example

# Spotter-SAST Comprehensive Environment Configuration
# ==================================================
# Copy this file to .env and configure for your organization

# ===========================================
# Organization & Basic Configuration
# ===========================================
# Organization details (affects auto-enabled frameworks)
ORGANIZATION_NAME=Your Organization
ORGANIZATION_INDUSTRY=general  # Options: healthcare, finance, ecommerce, government, general
ORGANIZATION_SIZE=medium       # Options: small, medium, large, enterprise
CONTACT_EMAIL=compliance@yourorg.com

# Node.js environment
NODE_ENV=production
SERVER_PORT=3000
LOG_LEVEL=info

# ===========================================
# Security & Authentication
# ===========================================
# JWT secret for authentication (CHANGE THIS IN PRODUCTION!)
JWT_SECRET=your-super-secure-256-bit-jwt-secret-key-here

# Authentication settings
ENABLE_RBAC=true
TOKEN_EXPIRY=24h
SESSION_TIMEOUT_HOURS=24
MAX_LOGIN_ATTEMPTS=5
LOCKOUT_DURATION_MINUTES=15

# Security features
ENABLE_AUDIT_LOGGING=true
ENABLE_COMPLIANCE_LOGGING=true

# ===========================================
# Enhanced Compliance Features
# ===========================================
# Global compliance settings
ENABLE_ENHANCED_COMPLIANCE=true
DEFAULT_COMPLIANCE_FRAMEWORKS=owasp,nist_csf

# 1. Compliance Drift Detection
ENABLE_COMPLIANCE_DRIFT_DETECTION=true
COMPLIANCE_BASELINE_RETENTION_DAYS=90
DRIFT_ALERT_THRESHOLD_MINOR=0.05
DRIFT_ALERT_THRESHOLD_MAJOR=0.15
DRIFT_ALERT_THRESHOLD_CRITICAL=0.25
AUTO_BASELINE_CREATION=true

# 2. Multi-Tenant Management
ENABLE_MULTI_TENANT_MANAGEMENT=true
DEFAULT_RISK_TOLERANCE=medium
TENANT_ISOLATION_MODE=strict
MAX_TENANTS_PER_INSTANCE=100

# 3. Evidence Collection & Chain of Custody
ENABLE_EVIDENCE_COLLECTION=true
EVIDENCE_CRYPTOGRAPHIC_SIGNING=true
EVIDENCE_ENCRYPTION_AT_REST=true
EVIDENCE_RETENTION_YEARS=7
COMPLIANCE_EVIDENCE_RETENTION_DAYS=2555
CHAIN_OF_CUSTODY_REQUIRED=true

# 4. Automated Remediation Workflows
ENABLE_AUTOMATED_REMEDIATION=true
REMEDIATION_AUTOMATION_LEVEL=semi_automatic
REMEDIATION_SLA_TRACKING=true
AUTO_QUARANTINE_CRITICAL=true
AUTO_ISOLATION_ENABLED=true
WORKFLOW_TIMEOUT_HOURS=24

# 5. Advanced Analytics & Reporting
ENABLE_ADVANCED_ANALYTICS=true
ANALYTICS_PREDICTIVE_MODELING=true
ANALYTICS_TREND_ANALYSIS=true
ANALYTICS_DASHBOARD_REFRESH_MINUTES=15
ANALYTICS_HISTORICAL_RETENTION_MONTHS=24
ANALYTICS_REAL_TIME_PROCESSING=true

# ===========================================
# SAST Tool Configuration
# ===========================================
# Tool configuration files
SEMGREP_CONFIG=auto
BANDIT_CONFIG=bandit.yaml
ESLINT_CONFIG=.eslintrc.security.js

# Scanning configuration
DEFAULT_SCAN_SCHEDULE=0 */6 * * *
COMPLIANCE_SCAN_FREQUENCY=daily
COMPLIANCE_SCAN_SCHEDULE=0 2 * * 1

# Alert thresholds by severity
ALERT_THRESHOLD_CRITICAL=0
ALERT_THRESHOLD_HIGH=5
ALERT_THRESHOLD_MEDIUM=20

# ===========================================
# Compliance Framework Configuration
# ===========================================
# Industry-specific frameworks (auto-enabled based on ORGANIZATION_INDUSTRY)
# healthcare: HIPAA + NIST CSF
# finance: PCI DSS + SOX + NIST CSF  
# ecommerce: PCI DSS + GDPR + CCPA
# government: FISMA + FedRAMP + NIST CSF
# general: OWASP + NIST CSF + ISO 27001

AUTO_ENABLE_INDUSTRY_FRAMEWORKS=true

# Individual framework controls
ENABLE_HIPAA=false
ENABLE_GDPR=false
ENABLE_PCI_DSS=false
ENABLE_ISO27001=false
ENABLE_SOX=false
ENABLE_NIST_CSF=true
ENABLE_CCPA=false
ENABLE_FISMA=false
ENABLE_FEDRAMP=false

# ===========================================
# HIPAA Configuration (Healthcare)
# ===========================================
HIPAA_PHI_DETECTION_SENSITIVITY=high
HIPAA_AUDIT_RETENTION_DAYS=2555
HIPAA_BREACH_NOTIFICATION_HOURS=60
HIPAA_RISK_ASSESSMENT_FREQUENCY=annual

# ===========================================
# GDPR Configuration (Privacy)
# ===========================================
GDPR_DATA_SUBJECT_NOTIFICATION_HOURS=72
GDPR_SUPERVISORY_AUTHORITY_NOTIFICATION=true
GDPR_RIGHT_TO_BE_FORGOTTEN=true
GDPR_PRIVACY_BY_DESIGN=true
GDPR_ENFORCE_DATA_RIGHTS=true
GDPR_CONSENT_TRACKING=true
GDPR_PII_DETECTION=true

# ===========================================
# PCI DSS Configuration (Payment Industry)
# ===========================================
PCI_CDE_ENVIRONMENT_ISOLATION=true
PCI_QUARTERLY_SCANS=true
PCI_PENETRATION_TESTING_ANNUAL=true
PCI_CARDHOLDER_DATA_RETENTION_LIMIT=90
PCI_CDE_CHECKS=true
PCI_NETWORK_SEGMENTATION=true

# ===========================================
# ISO 27001 Configuration
# ===========================================
ISO27001_RISK_ASSESSMENT_FREQUENCY=annual
ISO27001_CLASSIFICATION_LEVELS=public,internal,confidential,restricted

# ===========================================
# SOX Configuration (Financial)
# ===========================================
SOX_FINANCIAL_REPORTING_CONTROLS=true
SOX_INTERNAL_CONTROLS_TESTING=quarterly
SOX_MANAGEMENT_CERTIFICATION=true
SOX_AUDITOR_ATTESTATION=true
SOX_INTERNAL_CONTROLS=true
SOX_FINANCIAL_REPORTING=true
SOX_CHANGE_MANAGEMENT=true

# ===========================================
# NIST Cybersecurity Framework
# ===========================================
NIST_CYBERSECURITY_FRAMEWORK_VERSION=2.0
NIST_CSF_FUNCTIONS=identify,protect,detect,respond,recover
NIST_MATURITY_LEVEL_TARGET=3
NIST_RISK_MANAGEMENT_INTEGRATION=true

# ===========================================
# CCPA Configuration (California Privacy)
# ===========================================
CCPA_CONSUMER_RIGHTS=true
CCPA_TRANSPARENCY_CHECKS=true

# ===========================================
# FISMA/FedRAMP Configuration (Government)
# ===========================================
FISMA_SECURITY_CONTROLS=true
FISMA_CONTINUOUS_MONITORING=true

# ===========================================
# Risk Management Configuration
# ===========================================
# Risk tolerance levels and calculation
RISK_TOLERANCE_LEVEL=medium
RISK_CALCULATION_METHOD=weighted
RISK_SCORING_ALGORITHM=weighted_cvss_v3

# Risk weighting factors (must sum to 1.0)
BUSINESS_IMPACT_WEIGHT=0.3
TECHNICAL_SEVERITY_WEIGHT=0.4
COMPLIANCE_IMPACT_WEIGHT=0.3

# Risk tolerance by severity
RISK_TOLERANCE_ZERO_CRITICAL=0
RISK_TOLERANCE_ZERO_HIGH=0
RISK_TOLERANCE_MINIMAL_HIGH=1
RISK_TOLERANCE_LOW_CRITICAL=1
RISK_TOLERANCE_MEDIUM_CRITICAL=2
RISK_TOLERANCE_HIGH_CRITICAL=5

# ===========================================
# Workflow SLA Configuration (hours)
# ===========================================
HIPAA_PHI_EXPOSURE_SLA=4
PCI_CARDHOLDER_DATA_SLA=2  
GDPR_DATA_BREACH_SLA=72
SOX_FINANCIAL_CONTROLS_SLA=8

# ===========================================
# Notification Configuration
# ===========================================
# Enable compliance violation notifications
COMPLIANCE_NOTIFICATIONS=true
COMPLIANCE_LOG_RETENTION_DAYS=90

# Email notifications
NOTIFICATION_EMAIL_ENABLED=true
SMTP_HOST=smtp.yourorg.com
SMTP_PORT=587
SMTP_SECURE=true
SMTP_USER=compliance@yourorg.com
SMTP_PASS=your-smtp-password
EMAIL_FROM_ADDRESS=compliance@yourorg.com
EMAIL_FROM_NAME=Compliance System

# Webhook notifications
NOTIFICATION_WEBHOOK_ENABLED=true
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK
TEAMS_WEBHOOK_URL=https://outlook.office.com/webhook/YOUR/TEAMS/WEBHOOK
CUSTOM_WEBHOOK_URL=https://api.yourorg.com/compliance/webhook
WEBHOOK_RETRY_ATTEMPTS=3
WEBHOOK_TIMEOUT_SECONDS=30

# SMS notifications (emergency only)
NOTIFICATION_SMS_ENABLED=false
SMS_PROVIDER=twilio
TWILIO_ACCOUNT_SID=your-twilio-sid
TWILIO_AUTH_TOKEN=your-twilio-token
TWILIO_PHONE_NUMBER=+1-555-0123
EMERGENCY_SMS_NUMBERS=+1-555-0101,+1-555-0102

# Notification channels and schedules
NOTIFICATION_CHANNELS=email
IMMEDIATE_NOTIFY_SEVERITIES=critical,high
DAILY_COMPLIANCE_SUMMARY=true
WEEKLY_COMPLIANCE_REPORT=true

# ===========================================
# Escalation Configuration
# ===========================================
# Critical issues (immediate response)
CRITICAL_ESCALATION_IMMEDIATE=compliance_officer,ciso,ceo
CRITICAL_ESCALATION_1_HOUR=legal_team,board_chair
CRITICAL_ESCALATION_4_HOURS=external_counsel

# High issues
HIGH_ESCALATION_1_HOUR=compliance_officer,security_team
HIGH_ESCALATION_4_HOURS=department_heads
HIGH_ESCALATION_24_HOURS=executive_team

# Medium issues
MEDIUM_ESCALATION_4_HOURS=security_team
MEDIUM_ESCALATION_24_HOURS=compliance_officer
MEDIUM_ESCALATION_WEEKLY=management_team

# ===========================================
# Compliance Reporting Configuration
# ===========================================
DEFAULT_COMPLIANCE_REPORT_FORMAT=html
DEFAULT_REPORT_FORMAT=html
INCLUDE_EXECUTIVE_SUMMARY=true
INCLUDE_TECHNICAL_DETAILS=true
INCLUDE_REMEDIATION_TIMELINE=true
AUTO_GENERATE_COMPLIANCE_REPORTS=true
COMPLIANCE_REPORT_SCHEDULE=0 8 * * 1

# ===========================================
# Integration Configuration
# ===========================================
# CI/CD pipeline integration
CICD_INTEGRATION=true
FAIL_BUILD_ON_COMPLIANCE=false
COMPLIANCE_GATE_SEVERITIES=critical

# Ticketing system integration
TICKETING_INTEGRATION=false
TICKETING_SYSTEM=jira
JIRA_URL=https://yourorg.atlassian.net
JIRA_USER=compliance@yourorg.com
JIRA_TOKEN=your-jira-token
JIRA_PROJECT_KEY=COMP
AUTO_CREATE_TICKETS=false

# SIEM integration
SIEM_INTEGRATION_ENABLED=false
SIEM_TYPE=splunk
SIEM_API_ENDPOINT=https://your-siem.com/api
SIEM_API_TOKEN=your-siem-token

# Vulnerability management integration
VULN_MGMT_INTEGRATION=false
VULN_MGMT_TYPE=tenable
VULN_MGMT_API_ENDPOINT=https://cloud.tenable.com
VULN_MGMT_ACCESS_KEY=your-access-key
VULN_MGMT_SECRET_KEY=your-secret-key

# ===========================================
# Remediation Configuration
# ===========================================
AUTO_REMEDIATION=false
AUTO_REMEDIATION_MAX_SEVERITY=medium
REQUIRE_REMEDIATION_APPROVAL=true
CREATE_REMEDIATION_PR=true

# ===========================================
# Audit and Evidence Collection
# ===========================================
COLLECT_COMPLIANCE_EVIDENCE=true
COMPLIANCE_EVIDENCE_PATH=./compliance-evidence
EVIDENCE_STORAGE_LOCATION=./compliance-evidence
EVIDENCE_INTEGRITY_VERIFICATION=sha256
EVIDENCE_BACKUP_ENABLED=true
INCLUDE_SCAN_ARTIFACTS=true
INCLUDE_REMEDIATION_RECORDS=true

# ===========================================
# Performance Configuration
# ===========================================
MAX_CONCURRENT_COMPLIANCE_SCANS=3
COMPLIANCE_SCAN_TIMEOUT=1800
CACHE_COMPLIANCE_RESULTS=true
COMPLIANCE_CACHE_EXPIRATION=60
SCAN_PARALLEL_WORKERS=4
EVIDENCE_BATCH_SIZE=100
ANALYTICS_QUERY_TIMEOUT_SECONDS=30

# ===========================================
# Storage Configuration
# ===========================================
# File-based storage (default)
SCAN_TARGET=./
LOGS_DIR=./docker-logs
REPORTS_DIR=./docker-reports
COMPLIANCE_EVIDENCE_DIR=./docker-compliance-evidence

# Database storage (optional for enterprise)
USE_DATABASE_STORAGE=false
DATABASE_TYPE=postgresql
DATABASE_HOST=localhost
DATABASE_PORT=5432
DATABASE_NAME=compliance_db
DATABASE_USER=compliance_user
DATABASE_PASS=your-db-password
DATABASE_SSL=true
DATABASE_CONNECTION_POOL_SIZE=10

# Redis caching (optional)
REDIS_ENABLED=false
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_PASSWORD=your-redis-password
REDIS_CACHE_TTL_SECONDS=3600

# ===========================================
# Backup & Recovery
# ===========================================
BACKUP_EVIDENCE_ENABLED=true
BACKUP_EVIDENCE_FREQUENCY=daily
BACKUP_EVIDENCE_RETENTION_DAYS=90
BACKUP_CLOUD_PROVIDER=aws-s3
BACKUP_S3_BUCKET=your-compliance-backup-bucket
BACKUP_S3_REGION=us-east-1

# ===========================================
# Advanced Configuration
# ===========================================
# Feature flags
FEATURE_FLAG_PREDICTIVE_ANALYTICS=true
FEATURE_FLAG_AUTOMATED_BASELINE_UPDATES=true
FEATURE_FLAG_REAL_TIME_COMPLIANCE_MONITORING=true
FEATURE_FLAG_ADVANCED_THREAT_MODELING=false
FEATURE_FLAG_ML_ANOMALY_DETECTION=false

# Experimental features
ENABLE_EXPERIMENTAL_FEATURES=false
AI_COMPLIANCE_RECOMMENDATIONS=false
PREDICTIVE_COMPLIANCE_ANALYTICS=false
ML_RISK_MODEL_PATH=

# Custom configuration
CUSTOM_COMPLIANCE_RULES_FILE=config/custom-compliance-rules.json

# ===========================================
# Development and Testing
# ===========================================
DEBUG_COMPLIANCE_ENGINE=false
COMPLIANCE_DEBUG_MODE=false
COMPLIANCE_TEST_MODE=false
MOCK_COMPLIANCE_APIS=false
COMPLIANCE_TEST_DATA_DIR=./test-data/compliance
SKIP_EXTERNAL_VALIDATIONS=false

# Metrics and monitoring
EXPORT_COMPLIANCE_METRICS=false
METRICS_EXPORT_FORMAT=json
HEALTH_CHECK_ENABLED=true
HEALTH_CHECK_PORT=3001
METRICS_ENDPOINT_ENABLED=true
PROMETHEUS_METRICS_ENABLED=false

# ===========================================
# Legal & Audit Configuration
# ===========================================
LEGAL_HOLD_ENABLED=false
AUDIT_TRAIL_IMMUTABLE=true
EVIDENCE_DIGITAL_SIGNATURES=true
COMPLIANCE_OFFICER_EMAIL=compliance.officer@yourorg.com
EXTERNAL_AUDITOR_ACCESS=false
REGULATORY_REPORTING_ENABLED=true

# ===========================================
# Legacy Support (for backward compatibility)
# ===========================================
LEGACY_COMPLIANCE_MODE=false
LEGACY_REPORT_FORMAT=false
ENABLE_LEGACY_API=false

# =============================================================
# Quick Setup Instructions:
# =============================================================
# 1. Copy this file to .env
# 2. Set ORGANIZATION_INDUSTRY to auto-enable relevant frameworks:
#    - healthcare: Enables HIPAA + NIST CSF
#    - finance: Enables PCI DSS + SOX + NIST CSF
#    - ecommerce: Enables PCI DSS + GDPR + CCPA
#    - government: Enables FISMA + FedRAMP + NIST CSF
#    - general: Enables OWASP + NIST CSF + ISO 27001
# 3. Configure SMTP settings for email notifications
# 4. Set up webhook URLs for Slack/Teams integration
# 5. Adjust risk tolerance levels for your organization
# 6. Enable only the features you need to optimize performance
# 7. Update JWT_SECRET with a secure random string
# 8. Configure compliance officer contact information
# =============================================================