Detecting Vulnerabilities and Sharing Results via Email

This guide outlines how to utilize the Safety CLI tool for detecting vulnerabilities within your project dependencies and automatically sending an email notification when vulnerabilities are detected.

This process involves configuring a policy file to define the behavior of the scan and crafting a command to execute the scan and send the email based on the scan results.

Configuring the Policy FileTo begin, generate a policy file that will dictate how the Safety CLI scanner operates. This policy file allows for customization of the scanning process, including setting parameters that prevent the scan from failing with an exit code when vulnerabilities are detected.

Follow these steps:

1. Generate a new policy file by running:

safety generate policy_file

2. Open the generated .safety_policy.yml file and modify it as follows to prevent the scanner from exiting with a failure code due to detected vulnerabilities:

version: '3.0'

scanning-settings:
  max-depth: 8
  exclude: []
  include-files: []
  system:
    targets: []

report:
  dependency-vulnerabilities:
    enabled: true
    auto-ignore-in-report:
      python:
        environment-results: true
        unpinned-requirements: true
      cvss-severity: []

fail-scan-with-exit-code:
  dependency-vulnerabilities:
    enabled: false

security-updates:
  dependency-vulnerabilities:
    auto-security-updates-limit:
      - patch

​Place this .safety_policy.yml at the root of your project directory. For more detailed information on Safety CLI's policy file and its configurations, refer to the official documentation.

Running the Scan and Emailing Results

The following command combines scanning for vulnerabilities and conditionally sending an email if any vulnerabilities are found. The process is as follows:

1. Scan Execution: The Safety CLI tool is executed with a specified API key and stage. The results are saved in both JSON and human-readable text formats.

2. Vulnerability Detection: The jq tool is used to parse the JSON output to check for any known vulnerabilities.

3. Email Notification: If vulnerabilities are detected, an email is sent with the contents of the text report.

Execute the command below in your terminal:

safety --key "API_KEY" –stage cicd scan --save-as json report.json > text_report && jq 'any(.scan_results.projects[].files[].results.dependencies[].specifications[].vulnerabilities.known_vulnerabilities[]; .id != null)' report.json | xargs -I {} test {} = "true" && cat text_report | mail -s "Vulnerabilities found" [e-mail] || true

• The --save-as json report.json > text_report part saves Safety CLI results in a JSON format to report.json, while redirecting the standard output to be saved as human-readable text_report.

• The jq command checks for the presence of any vulnerabilities by examining the id fields within the scan results. If any vulnerabilities are found (true), the subsequent command is triggered.

• xargs -I {} test {} = "true" uses the result from jq to conditionally proceed with sending an email if vulnerabilities are detected.

• The mail command constructs an email with the subject "Vulnerabilities found" and the content of text_report, sending it to the specified email address.

• The || true ensures that, regardless of the exit codes in the pipe, the command sequence exits with a status code of 0 to prevent interrupting any automated pipelines due to a failure status.

Alternative Approaches

While the above command provides a quick and integrated solution for scanning and alerting, it's possible to incorporate this logic into a script for more complex workflows or to enhance readability and maintainability.This guide aims to facilitate a seamless integration of vulnerability scanning and notification within your CI/CD pipeline, ensuring that your team is promptly informed of any security issues detected in your project dependencies.