Security Scan Results

Show the user the latest output of ai-security-scan, which runs automatically on every deploy and writes its JSON to /home/ubuntu/security_scan.json. Renders a score, per-severity counts, and top findings.

Step 1: Resolve API token

echo "$NOMETRIA_API_KEY"
echo "$NOMETRIA_TOKEN"
grep -s 'NOMETRIA_API_KEY\|NOMETRIA_TOKEN' .env .env.local 2>/dev/null
cat ~/.nometria/credentials.json 2>/dev/null

If no token: tell the user to run /login. Stop.

Store: TOKEN="<the token>"

Step 2: Identify the app

cat nometria.json 2>/dev/null

If absent, use $ARGUMENTS or list migrations:

curl -s -X POST https://app.nometria.com/listUserMigrations \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{}'

Store: APP_ID="<app_id>".

Step 3: Fetch the scan

curl -s -X POST https://app.nometria.com/getSecurityScan \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d "{\"app_id\": \"$APP_ID\"}"

Response shape:

{
  "scan": {
    "passed": false,
    "scanned_files": 142,
    "summary": { "critical": 1, "high": 3, "medium": 5, "low": 2, "total": 11 },
    "findings": [
      { "rule_id": "SEC-001", "severity": "CRITICAL", "file": "src/api.js", "line": 42,
        "message": "Hardcoded API key", "snippet": "...", "fix": "..." }
    ]
  },
  "status": "ok"
}

If status === "no_scan_yet" - tell the user no scan has run yet on this app and suggest triggering a deploy. Stop.

Step 4: Compute and display the score

Score (0-100) = 100 − (critical × 25) − (high × 10) − (medium × 3) − (low × 1), clamped to [0,100].

Display:

Security Score: 72/100
  CRITICAL: 1   HIGH: 3   MEDIUM: 5   LOW: 2
  Total findings: 11   Scanned files: 142

Step 5: Show top findings

List the top 5 findings (sorted by severity, then file). For each:

  [CRITICAL] SEC-001 - Hardcoded API key
    src/api.js:42
    Fix: Move the key to .env and reference via process.env.API_KEY

Step 6: Offer next steps

• For each CRITICAL/HIGH finding, point the user at the exact file:line so they can open it
• If the customer asks "how do I fix this", read the file and propose the fix as a diff
• Mention they can run a full local scan with: pip install ai-security-scan && security-scan .

Do all of the above. Execute the curl call and report results to the user.