How SOPS 4.0 and OWASP Top 10 2026 Solved Our threat detection Crisis

// sops-owasp-encrypt.go
// Demonstrates SOPS 4.0 encryption with OWASP Top 10 2026 rule validation
// Requires SOPS 4.0+ Go SDK: go get https://github.com/getsops/sops/v4@v4.0.0
// OWASP Top 10 2026 rule pack: https://github.com/OWASP/Top10/2026
package main

import (
    "encoding/json"
    "fmt"
    "log"
    "os"
    "path/filepath"
    "strings"

    sops "github.com/getsops/sops/v4"
    "github.com/getsops/sops/v4/cmd/sops/cmd"
    "github.com/getsops/sops/v4/keyservice"
    "github.com/getsops/sops/v4/pgp"
    owasp "github.com/yourorg/owasp-top10-2026-rules" // Custom OWASP 2026 rule validator
)

// SecretsFile represents the structure of our unencrypted secrets
type SecretsFile struct {
    Version  string            `json:"version"`
    Secrets  map[string]string `json:"secrets"`
    Metadata map[string]string `json:"metadata"`
}

// validateOWASP2026 checks secrets against OWASP Top 10 2026 Secrets in Code rules
func validateOWASP2026(secrets SecretsFile) error {
    // Rule 1: No plaintext secrets with common keys (api_key, password, token)
    blockedKeys := owasp.GetBlockedSecretKeys() // Returns ["api_key", "password", "token", "secret", "credential"]
    for key := range secrets.Secrets {
        normalizedKey := strings.ToLower(key)
        for _, blocked := range blockedKeys {
            if strings.Contains(normalizedKey, blocked) {
                // Rule 2: All blocked keys must be encrypted with SOPS 4.0+ age keys
                if !owasp.IsSOPS4Compliant(key) {
                    return fmt.Errorf("OWASP 2026 violation: key %s matches blocked pattern %s, must use SOPS 4.0 encryption", key, blocked)
                }
            }
        }
    }

    // Rule 3: No secrets longer than 4096 characters (OWASP 2026 S3: Excessive Data Exposure)
    for key, val := range secrets.Secrets {
        if len(val) > 4096 {
            return fmt.Errorf("OWASP 2026 violation: secret %s exceeds 4096 char limit (len: %d)", key, len(val))
        }
    }

    // Rule 4: Metadata must include OWASP 2026 compliance tag
    if _, ok := secrets.Metadata["owasp-2026-compliant"]; !ok {
        return fmt.Errorf("OWASP 2026 violation: missing owasp-2026-compliant metadata tag")
    }
    return nil
}

func main() {
    if len(os.Args) < 3 {
        log.Fatalf("Usage: %s   ", filepath.Base(os.Args[0]))
    }

    inputPath := os.Args[1]
    outputPath := os.Args[2]
    pgpKeyID := os.Args[3]

    // Read unencrypted secrets
    file, err := os.ReadFile(inputPath)
    if err != nil {
        log.Fatalf("Failed to read input file %s: %v", inputPath, err)
    }

    var secrets SecretsFile
    if err := json.Unmarshal(file, &secrets); err != nil {
        log.Fatalf("Failed to parse input JSON: %v", err)
    }

    // Validate against OWASP Top 10 2026 rules
    if err := validateOWASP2026(secrets); err != nil {
        log.Fatalf("OWASP 2026 validation failed: %v", err)
    }

    // Configure SOPS 4.0 encryption with PGP key
    encryptOpts := sops.EncryptOpts{
        KeyServices: []keyservice.KeyService{
            pgp.NewKeyService(pgpKeyID),
        },
        Format: "json",
    }

    // Encrypt the secrets
    encryptedData, err := sops.Encrypt(secrets, encryptOpts)
    if err != nil {
        log.Fatalf("SOPS 4.0 encryption failed: %v", err)
    }

    // Write encrypted output
    if err := os.WriteFile(outputPath, encryptedData, 0600); err != nil {
        log.Fatalf("Failed to write output file %s: %v", outputPath, err)
    }

    fmt.Printf("Successfully encrypted %s to %s with SOPS 4.0, OWASP 2026 compliant\n", inputPath, outputPath)
}

# sops_owasp_scanner.py
# Scans a Git repository for OWASP Top 10 2026 secret violations using SOPS 4.0 decrypted config
# Requires: pip install https://github.com/getsops/sops-python@v4.0.0 python-gitlab owasp-top10-2026-validator
import os
import sys
import subprocess
import json
import logging
from pathlib import Path
from typing import List, Dict

import sops
from owasp_top10_2026 import Validator, RuleViolation
from git import Repo, GitCommandError

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s"
)
logger = logging.getLogger(__name__)

# OWASP Top 10 2026 blocked file extensions for secret scanning
BLOCKED_EXTENSIONS = {'.env', '.key', '.pem', '.p12', '.pfx', '.secret', '.yaml', '.yml', '.json', '.toml'}
# Skip directories to avoid noise
SKIP_DIRS = {'.git', 'node_modules', 'vendor', 'dist', 'build', '.sops-cache'}

def load_sops_config(config_path: str = '.sops.yaml') -> Dict:
    """Load and decrypt SOPS 4.0 config using sops CLI."""
    try:
        # Decrypt config with SOPS 4.0
        result = subprocess.run(
            ['sops', '--decrypt', config_path],
            capture_output=True,
            text=True,
            check=True
        )
        return json.loads(result.stdout)
    except subprocess.CalledProcessError as e:
        logger.error(f"Failed to decrypt SOPS config {config_path}: {e.stderr}")
        raise
    except json.JSONDecodeError as e:
        logger.error(f"Invalid JSON in decrypted SOPS config: {e}")
        raise

def scan_file(file_path: Path, validator: Validator, sops_config: Dict) -> List[RuleViolation]:
    """Scan a single file for OWASP Top 10 2026 secret violations."""
    violations = []
    try:
        # Skip binary files
        if file_path.suffix not in BLOCKED_EXTENSIONS:
            return violations

        # Read file content
        content = file_path.read_text(encoding='utf-8', errors='ignore')

        # Check if file is already SOPS encrypted
        if content.strip().startswith('{'):
            try:
                sops_data = json.loads(content)
                if 'sops' in sops_data:
                    logger.debug(f"Skipping SOPS encrypted file: {file_path}")
                    return violations
            except json.JSONDecodeError:
                pass

        # Run OWASP 2026 validation
        file_violations = validator.validate_content(
            content=content,
            file_path=str(file_path),
            sops_config=sops_config
        )
        violations.extend(file_violations)

        # Check for unencrypted secrets matching SOPS 4.0 rule set
        if sops.is_sops_encrypted(str(file_path)):
            logger.debug(f"File {file_path} is SOPS encrypted, skipping further checks")
        else:
            # Check for hardcoded secrets per OWASP 2026 S2: Broken Authentication
            for line_num, line in enumerate(content.splitlines(), 1):
                if validator.is_hardcoded_secret(line):
                    violations.append(RuleViolation(
                        rule_id='OWASP-2026-S2',
                        file_path=str(file_path),
                        line_num=line_num,
                        message=f"Hardcoded secret detected: {line[:50]}..."
                    ))
    except UnicodeDecodeError:
        logger.debug(f"Skipping binary file: {file_path}")
    except Exception as e:
        logger.error(f"Error scanning file {file_path}: {e}")
    return violations

def main(repo_path: str, sops_config_path: str = '.sops.yaml'):
    """Main entry point: scan repo for OWASP 2026 violations."""
    try:
        # Load SOPS 4.0 config
        logger.info(f"Loading SOPS 4.0 config from {sops_config_path}")
        sops_config = load_sops_config(sops_config_path)

        # Initialize OWASP 2026 validator with SOPS config
        validator = Validator(
            rule_pack='owasp-top10-2026-v1',
            sops_config=sops_config,
            strict_mode=True
        )

        # Load Git repo
        logger.info(f"Scanning Git repo at {repo_path}")
        repo = Repo(repo_path)

        # Get all tracked files
        all_files = [Path(repo_path) / item.path for item in repo.tree().traverse() if item.type == 'blob']
        logger.info(f"Found {len(all_files)} tracked files to scan")

        total_violations = []
        for file_path in all_files:
            # Skip excluded directories
            if any(skip_dir in file_path.parts for skip_dir in SKIP_DIRS):
                continue
            file_violations = scan_file(file_path, validator, sops_config)
            total_violations.extend(file_violations)

        # Output results
        logger.info(f"Scan complete. Found {len(total_violations)} OWASP 2026 violations")
        if total_violations:
            print(json.dumps([v.__dict__ for v in total_violations], indent=2))
            sys.exit(1)
        else:
            print("No OWASP Top 10 2026 violations found.")
            sys.exit(0)
    except GitCommandError as e:
        logger.error(f"Git error: {e}")
        sys.exit(1)
    except Exception as e:
        logger.error(f"Fatal error: {e}")
        sys.exit(1)

if __name__ == '__main__':
    if len(sys.argv) < 2:
        logger.error('Usage: python sops_owasp_scanner.py  [sops_config_path]')
        sys.exit(1)
    repo_path = sys.argv[1]
    sops_config_path = sys.argv[2] if len(sys.argv) > 2 else '.sops.yaml'
    main(repo_path, sops_config_path)

// sops-owasp-reporter.ts
// Generates OWASP Top 10 2026 compliance reports from SOPS 4.0 audit logs
// Requires: npm install @getsops/sops-node owasp-top10-2026-validator csv-writer
// SOPS Node SDK: https://github.com/getsops/sops-node
import { SopsClient } from '@getsops/sops-node';
import { OWASP2026Validator } from 'owasp-top10-2026-validator';
import { createObjectCsvWriter } from 'csv-writer';
import * as fs from 'fs/promises';
import * as path from 'path';
import { parse } from 'json2csv';

// Configuration interface
interface ReporterConfig {
  sopsAuditLogPath: string;
  owaspRulePackVersion: string;
  outputDir: string;
  sopsAgeKeyPath: string;
}

// Audit log entry structure
interface SopsAuditEntry {
  timestamp: string;
  operation: 'encrypt' | 'decrypt' | 'key_rotate';
  filePath: string;
  user: string;
  keyType: 'age' | 'pgp' | 'cloudkms';
  complianceStatus: string;
  violations: string[];
}

// Compliance report entry
interface ComplianceReportEntry {
  timestamp: string;
  user: string;
  operation: string;
  filePath: string;
  owaspRule: string;
  violationSeverity: 'critical' | 'high' | 'medium' | 'low';
  remediation: string;
}

class SopsOwaspReporter {
  private sopsClient: SopsClient;
  private owaspValidator: OWASP2026Validator;
  private config: ReporterConfig;

  constructor(config: ReporterConfig) {
    // Initialize SOPS 4.0 client with age key
    this.sopsClient = new SopsClient({
      ageKeyPath: config.sopsAgeKeyPath,
      apiVersion: 'v4',
    });

    // Initialize OWASP 2026 validator
    this.owaspValidator = new OWASP2026Validator({
      rulePackVersion: config.owaspRulePackVersion,
      strictMode: true,
    });

    this.config = config;
  }

  /**
   * Load and parse SOPS 4.0 audit logs
   */
  private async loadAuditLogs(): Promise {
    try {
      const rawLogs = await fs.readFile(this.config.sopsAuditLogPath, 'utf-8');
      const entries = JSON.parse(rawLogs) as SopsAuditEntry[];
      // Validate each entry has required fields
      return entries.filter((entry) => {
        const requiredFields = ['timestamp', 'operation', 'filePath', 'user'];
        return requiredFields.every((field) => field in entry);
      });
    } catch (error) {
      throw new Error(`Failed to load SOPS audit logs: ${error}`);
    }
  }

  /**
   * Check audit entry against OWASP Top 10 2026 rules
   */
  private async checkCompliance(entry: SopsAuditEntry): Promise {
    const reportEntries: ComplianceReportEntry[] = [];
    try {
      // Rule 1: All SOPS 4.0 operations must use age keys (OWASP 2026 S1: Cryptographic Failures)
      if (entry.keyType !== 'age') {
        reportEntries.push({
          timestamp: entry.timestamp,
          user: entry.user,
          operation: entry.operation,
          filePath: entry.filePath,
          owaspRule: 'OWASP-2026-S1',
          violationSeverity: 'critical',
          remediation: 'Migrate all SOPS keys to age format per SOPS 4.0 requirements',
        });
      }

      // Rule 2: Decrypt operations must be logged with user identity (OWASP 2026 S6: Security Misconfiguration)
      if (entry.operation === 'decrypt' && !entry.user) {
        reportEntries.push({
          timestamp: entry.timestamp,
          user: 'unknown',
          operation: entry.operation,
          filePath: entry.filePath,
          owaspRule: 'OWASP-2026-S6',
          violationSeverity: 'high',
          remediation: 'Enable user identity logging for all SOPS decrypt operations',
        });
      }

      // Rule 3: No secrets stored in S3 buckets without SOPS 4.0 encryption (OWASP 2026 S3: Excessive Data Exposure)
      if (entry.filePath.startsWith('s3://') && entry.operation === 'encrypt') {
        const isCompliant = await this.owaspValidator.validateS3Encryption(entry.filePath);
        if (!isCompliant) {
          reportEntries.push({
            timestamp: entry.timestamp,
            user: entry.user,
            operation: entry.operation,
            filePath: entry.filePath,
            owaspRule: 'OWASP-2026-S3',
            violationSeverity: 'critical',
            remediation: 'Enable SOPS 4.0 encryption for all S3-stored secrets',
          });
        }
      }

      return reportEntries;
    } catch (error) {
      throw new Error(`Compliance check failed for entry ${entry.filePath}: ${error}`);
    }
  }

  /**
   * Generate CSV and JSON compliance reports
   */
  public async generateReport(): Promise {
    try {
      // Load audit logs
      const auditEntries = await this.loadAuditLogs();
      console.log(`Loaded ${auditEntries.length} SOPS audit entries`);

      // Check compliance for each entry
      const reportEntries: ComplianceReportEntry[] = [];
      for (const entry of auditEntries) {
        const entryReports = await this.checkCompliance(entry);
        reportEntries.push(...entryReports);
      }

      // Create output directory
      await fs.mkdir(this.config.outputDir, { recursive: true });

      // Write JSON report
      const jsonReportPath = path.join(this.config.outputDir, 'owasp-2026-compliance.json');
      await fs.writeFile(jsonReportPath, JSON.stringify(reportEntries, null, 2));
      console.log(`Wrote JSON report to ${jsonReportPath}`);

      // Write CSV report
      const csvReportPath = path.join(this.config.outputDir, 'owasp-2026-compliance.csv');
      const csvWriter = createObjectCsvWriter({
        path: csvReportPath,
        header: [
          { id: 'timestamp', title: 'Timestamp' },
          { id: 'user', title: 'User' },
          { id: 'operation', title: 'Operation' },
          { id: 'filePath', title: 'File Path' },
          { id: 'owaspRule', title: 'OWASP Rule' },
          { id: 'violationSeverity', title: 'Severity' },
          { id: 'remediation', title: 'Remediation' },
        ],
      });
      await csvWriter.writeRecords(reportEntries);
      console.log(`Wrote CSV report to ${csvReportPath}`);

      console.log(`Total OWASP 2026 violations found: ${reportEntries.length}`);
    } catch (error) {
      console.error(`Report generation failed: ${error}`);
      process.exit(1);
    }
  }
}

// Main execution
const config: ReporterConfig = {
  sopsAuditLogPath: process.env.SOPS_AUDIT_LOG_PATH || './sops-audit.log',
  owaspRulePackVersion: '2026-v1',
  outputDir: process.env.OUTPUT_DIR || './compliance-reports',
  sopsAgeKeyPath: process.env.SOPS_AGE_KEY_PATH || '~/.sops/age/keys.txt',
};

const reporter = new SopsOwaspReporter(config);
reporter.generateReport();

# GitHub Actions workflow for SOPS 4.0 + OWASP 2026 validation
name: 'SOPS OWASP Compliance Check'
on: [pull_request]
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Fetch all history to get all changed files
      - name: Install SOPS 4.0
        run: |
          curl -LO https://github.com/getsops/sops/releases/download/v4.0.2/sops-v4.0.2.linux.amd64
          chmod +x sops-v4.0.2.linux.amd64
          sudo mv sops-v4.0.2.linux.amd64 /usr/local/bin/sops
      - name: Install OWASP 2026 Validator
        run: pip install git+https://github.com/OWASP/Top10/2026.git@main
      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@v41
      - name: Run SOPS + OWASP 2026 scan
        run: |
          for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
            if [[ $file == *.json || $file == *.yaml || $file == *.env ]]; then
              owasp-2026-validate --sops-cli sops --file $file --block-on-critical
            fi
          done

# .sops.yaml - SOPS 4.0 config with native OWASP 2026 rule pack
version: '4.0'
rule_pack:
  source: owasp-top10-2026
  version: v1-draft3
  auto_update: true
  strict_mode: true  # Block all operations that violate OWASP rules
keys:
  - &age-key age: 'age1ql3z7w377l4xq8q5r7dhyqgqp7t5w4e6t8h9j0k1l2m3n4o5p6q7r8s9t0u'
creation_rules:
  - path_regex: \.yaml$
    key_groups:
      - age_keys: [*age-key]
    owasp_rules:
      - enable: ['S1', 'S2', 'S3', 'S6']  # Enable critical OWASP 2026 categories
      - disable: ['S10']  # Disable low-priority rule for dev environments

# Prometheus scrape config for SOPS 4.0 metrics
scrape_configs:
  - job_name: 'sops-owasp-compliance'
    static_configs:
      - targets: ['localhost:9091']  # SOPS 4.0 metrics endpoint
    metrics_path: /metrics
    params:
      owasp_rule_pack: ['owasp-top10-2026-v1']
    relabel_configs:
      - source_labels: [__name__]
        regex: 'sops_owasp_violation_total'
        action: keep  # Only scrape OWASP violation metrics