Skip to content

Feature/offline basemap - #302

Closed
BlessedRebuS wants to merge 2 commits into
devfrom
feature/offline-basemap
Closed

Feature/offline basemap#302
BlessedRebuS wants to merge 2 commits into
devfrom
feature/offline-basemap

Conversation

@BlessedRebuS

Copy link
Copy Markdown
Owner

Offline Dark Basemap for the Map

#295

Problem

CARTO began stamping an API KEY REQUIRED watermark across every tile served
without a key, and its raster basemap service is being retired. The dashboard
map relied on CARTO's dark_all tiles, so every unconfigured instance showed a
defaced map and "fixing" it meant plumbing a per-install API key.

We prefer using open-source alternatives rather than third-party API keys when possible, in order to be as independent as possible.

What changed

The map is now fully offline and self-contained. It renders from a single
bundled dark raster pyramid (z0–z6) shipped inside the repo, no CDN, orthird
party tile server.

  • Shipped the entire map: the full 5 461-tile / ~25 MB dark pyramid is
    committed under src/templates/static/tiles/{z}/{x}/{y}.jpg and served as a
    static asset. Deployers get a working map with zero build or configuration
    steps.
  • Darker unified style: moved the desaturation/darkening filter onto
    :root so the main IP map and the per-IP popup map share the same dark
    treatment (previously only the main map was filtered).
  • Docs: updated README, docs/dashboard.md, and docs/architecture.md to
    note the bundled offline basemap.

Why the darkest single variant

Following review, the map stays on one hardcoded style (a darker
desaturation of the bundled Esri dark canvas) rather than becoming a picker or
multi-style surface. Only a coarse global overview (z0–z6) is ever needed, so a
small pre-rendered pyramid is sufficient and keeps Leaflet (already vendored
for marker clustering) as the only map runtime.

In the future we will add a button to change the whole Krawl style, including the map.

Remove CARTO and all tile-provider configurability. The map now renders
from a single bundled dark raster pyramid (z0-z6) served offline from
/static/tiles — no CDN, no tile server, no API key, no network at runtime.

- scripts/build_tiles.py: one-time build-time downloader (Esri Canvas
  World Dark Gray Base, keyless); output is committed to the repo
- Commit the full 5461-tile / 25MB dark pyramid under
  src/templates/static/tiles/ so the image ships a working map with no
  generation step
- map.js / _ip_detail.html: hardcode the local tile path, maxZoom 6
- config.py/config.yaml/helm: drop the map:tile_url/api_key surface
- dashboard.css: apply the darker desaturation filter on :root so the
  main map and per-IP popup map share the same style
- docs: note the bundled offline basemap
@BlessedRebuS BlessedRebuS self-assigned this Aug 31, 2026
@BlessedRebuS BlessedRebuS added the frontend Edits the graphic or frontend of Krawl label Aug 31, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Bandit — security issues

No HIGH severity issues found.

Code scanned:
	Total lines of code: 12651
	Total lines skipped (#nosec): 0
	Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 53
		Medium: 1
		High: 0
	Total issues (by confidence):
		Undefined: 0
		Low: 0
		Medium: 6
		High: 48
Files skipped (0):
View full report
Working... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
Run started:2026-08-31 13:12:47.606633+00:00

Test results:
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: ''
   Severity: Low   Confidence: Medium
   CWE: CWE-259 (https://cwe.mitre.org/data/definitions/259.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b105_hardcoded_password_string.html
   Location: src/app.py:215:20
214	
215	    password_line = ""
216	    if config.dashboard_password_generated:

--------------------------------------------------
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: ''
   Severity: Low   Confidence: Medium
   CWE: CWE-259 (https://cwe.mitre.org/data/definitions/259.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b105_hardcoded_password_string.html
   Location: src/database/credentials.py:160:54
159	                .filter(CredentialAttempt.password.isnot(None))
160	                .filter(CredentialAttempt.password != "")
161	                .all()

--------------------------------------------------
>> Issue: [B104:hardcoded_bind_all_interfaces] Possible binding to all interfaces.
   Severity: Medium   Confidence: Medium
   CWE: CWE-605 (https://cwe.mitre.org/data/definitions/605.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b104_hardcoded_bind_all_interfaces.html
   Location: src/dependencies.py:90:11
89	
90	    return "0.0.0.0"  # noqa: S104 — sentinel for unknown client, not a socket bind
91	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:19:11
18	    wl = get_wordlists()
19	    return random.choice(wl.username_prefixes) + random.choice(wl.username_suffixes)
20	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:19:49
18	    wl = get_wordlists()
19	    return random.choice(wl.username_prefixes) + random.choice(wl.username_suffixes)
20	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:26:24
25	    templates = [
26	        lambda: "".join(random.choices(string.ascii_letters + string.digits, k=12)),
27	        lambda: f"{random.choice(wl.password_prefixes)}{random.randint(100, 999)}!",

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:27:19
26	        lambda: "".join(random.choices(string.ascii_letters + string.digits, k=12)),
27	        lambda: f"{random.choice(wl.password_prefixes)}{random.randint(100, 999)}!",
28	        lambda: f"{random.choice(wl.simple_passwords)}{random.randint(1000, 9999)}",

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:27:56
26	        lambda: "".join(random.choices(string.ascii_letters + string.digits, k=12)),
27	        lambda: f"{random.choice(wl.password_prefixes)}{random.randint(100, 999)}!",
28	        lambda: f"{random.choice(wl.simple_passwords)}{random.randint(1000, 9999)}",

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:28:19
27	        lambda: f"{random.choice(wl.password_prefixes)}{random.randint(100, 999)}!",
28	        lambda: f"{random.choice(wl.simple_passwords)}{random.randint(1000, 9999)}",
29	        lambda: "".join(random.choices(string.ascii_lowercase, k=8)),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:28:55
27	        lambda: f"{random.choice(wl.password_prefixes)}{random.randint(100, 999)}!",
28	        lambda: f"{random.choice(wl.simple_passwords)}{random.randint(1000, 9999)}",
29	        lambda: "".join(random.choices(string.ascii_lowercase, k=8)),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:29:24
28	        lambda: f"{random.choice(wl.simple_passwords)}{random.randint(1000, 9999)}",
29	        lambda: "".join(random.choices(string.ascii_lowercase, k=8)),
30	    ]

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:31:11
30	    ]
31	    return random.choice(templates)()
32	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:39:25
38	        username = random_username()
39	    return f"{username}@{random.choice(wl.email_domains)}"
40	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:48:11
47	    wl = get_wordlists()
48	    return random.choice(wl.server_headers)
49	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:54:18
53	    wl = get_wordlists()
54	    key = "".join(random.choices(string.ascii_letters + string.digits, k=32))
55	    return random.choice(wl.api_key_prefixes) + key

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:55:11
54	    key = "".join(random.choices(string.ascii_letters + string.digits, k=32))
55	    return random.choice(wl.api_key_prefixes) + key
56	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:61:11
60	    wl = get_wordlists()
61	    return random.choice(wl.database_names)
62	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:67:20
66	    content = "# Production Credentials\n\n"
67	    for _i in range(random.randint(3, 7)):
68	        username = random_username()

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:81:20
80	    content += "User Passwords:\n"
81	    for _i in range(random.randint(5, 10)):
82	        username = random_username()

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:92:19
91	    users = []
92	    for i in range(random.randint(3, 8)):
93	        username = random_username()

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:100:24
99	                "password": random_password(),
100	                "role": random.choice(wl.user_roles),
101	                "api_token": random_api_key(),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:112:22
111	            "public_key": "pk_live_"
112	            + "".join(random.choices(string.ascii_letters + string.digits, k=24)),
113	            "secret_key": random_api_key(),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:117:22
116	            "access_key_id": "AKIA"
117	            + "".join(random.choices(string.ascii_uppercase + string.digits, k=16)),
118	            "secret_access_key": "".join(

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:119:16
118	            "secret_access_key": "".join(
119	                random.choices(string.ascii_letters + string.digits + "+/", k=40)
120	            ),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:124:22
123	            "api_key": "SG."
124	            + "".join(random.choices(string.ascii_letters + string.digits, k=48))
125	        },

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:128:22
127	            "account_sid": "AC"
128	            + "".join(random.choices(string.ascii_lowercase + string.digits, k=32)),
129	            "auth_token": "".join(

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:130:16
129	            "auth_token": "".join(
130	                random.choices(string.ascii_lowercase + string.digits, k=32)
131	            ),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:150:28
149	                    "email": random_email(username),
150	                    "role": random.choice(wl.user_roles),
151	                }

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:158:38
157	            {
158	                "users": random_users(random.randint(2, 5)),
159	                "total": random.randint(50, 500),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:159:25
158	                "users": random_users(random.randint(2, 5)),
159	                "total": random.randint(50, 500),
160	            },

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:168:30
167	                    {
168	                        "id": random.randint(1, 100),
169	                        "name": random_username(),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:179:28
178	                "database": {
179	                    "host": random.choice(wl.database_hosts),
180	                    "username": random_username(),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:188:24
187	                    + "".join(
188	                        random.choices(string.ascii_uppercase + string.digits, k=16)
189	                    ),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:196:28
195	            {
196	                "app_name": random.choice(wl.application_names),
197	                "debug": random.choice([True, False]),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:197:25
196	                "app_name": random.choice(wl.application_names),
197	                "debug": random.choice([True, False]),
198	                "secret_key": random_api_key(),

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:203:31
202	        ),
203	        "/.env": f"""APP_NAME={random.choice(wl.application_names)}
204	DEBUG={random.choice(['true', 'false'])}

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:204:7
203	        "/.env": f"""APP_NAME={random.choice(wl.application_names)}
204	DEBUG={random.choice(['true', 'false'])}
205	APP_KEY=base64:{''.join(random.choices(string.ascii_letters + string.digits, k=32))}=

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:205:24
204	DEBUG={random.choice(['true', 'false'])}
205	APP_KEY=base64:{''.join(random.choices(string.ascii_letters + string.digits, k=32))}=
206	DB_CONNECTION=mysql

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:212:31
211	DB_PASSWORD={random_password()}
212	AWS_ACCESS_KEY_ID=AKIA{''.join(random.choices(string.ascii_uppercase + string.digits, k=16))}
213	AWS_SECRET_ACCESS_KEY={''.join(random.choices(string.ascii_letters + string.digits + '+/', k=40))}

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:213:31
212	AWS_ACCESS_KEY_ID=AKIA{''.join(random.choices(string.ascii_uppercase + string.digits, k=16))}
213	AWS_SECRET_ACCESS_KEY={''.join(random.choices(string.ascii_letters + string.digits + '+/', k=40))}
214	STRIPE_SECRET={random_api_key()}

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:228:12
227	    selected_files = [
228	        (f, random.randint(1024, 1024 * 1024))
229	        for f in random.sample(files, min(6, len(files)))

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/generators.py:229:17
228	        (f, random.randint(1024, 1024 * 1024))
229	        for f in random.sample(files, min(6, len(files)))
230	    ]

--------------------------------------------------
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: ''
   Severity: Low   Confidence: Medium
   CWE: CWE-259 (https://cwe.mitre.org/data/definitions/259.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b105_hardcoded_password_string.html
   Location: src/routes/api.py:1581:8
1580	        "account_id": "",
1581	        "auth_token": "",
1582	        "list_id": None,
1583	    }
1584	    save_config(cfg)
1585	    return JSONResponse(content={"ok": True})
1586	
1587	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/routes/honeypot.py:102:11
101	        return False
102	    return random.randint(1, 100) <= config.probability_error_codes
103	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/routes/honeypot.py:110:11
109	        error_codes = [400, 401, 403, 404, 500, 502, 503]
110	    return random.choice(error_codes)
111	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/routes/honeypot.py:597:20
596	    """Generate random word salad to confuse AI training data scrapers."""
597	    return " ".join(random.choice(_TARPIT_WORDS) for _ in range(n_words))
598	

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/routes/honeypot.py:623:16
622	
623	    num_pages = random.randint(*config.links_per_page_range)
624	    content = ""

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/routes/honeypot.py:638:20
637	                [
638	                    random.choice(config.char_space)
639	                    for _ in range(random.randint(*config.links_length_range))

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/routes/honeypot.py:639:35
638	                    random.choice(config.char_space)
639	                    for _ in range(random.randint(*config.links_length_range))
640	                ]

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: src/routes/honeypot.py:649:22
648	        for _ in range(num_pages):
649	            address = random.choice(webpages)
650	            content += f"""

--------------------------------------------------
>> Issue: [B404:blacklist] Consider possible security implications associated with the subprocess module.
   Severity: Low   Confidence: High
   CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_imports.html#b404-import-subprocess
   Location: src/tasks/db_dump.py:6:0
5	import sqlite3
6	import subprocess
7	

--------------------------------------------------
>> Issue: [B603:subprocess_without_shell_equals_true] subprocess call - check for execution of untrusted input.
   Severity: Low   Confidence: High
   CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html
   Location: src/tasks/db_dump.py:92:17
91	    try:
92	        result = subprocess.run(  # noqa: S603 — fixed pg_dump, list args, no shell
93	            cmd, env=env, capture_output=True, text=True, timeout=300
94	        )
95	        if result.returncode == 0:

--------------------------------------------------
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: ''
   Severity: Low   Confidence: Medium
   CWE: CWE-259 (https://cwe.mitre.org/data/definitions/259.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b105_hardcoded_password_string.html
   Location: src/webhooks.py:34:12
33	            "account_id": "",
34	            "auth_token": "",
35	            "list_id": None,
36	            "list_name": "krawl_banlist",
37	            "list_description": "IPs banned by Krawl honeypot",
38	            "sync_interval_minutes": 30,
39	            "categories": ["attacker"],
40	            "last_sync": None,
41	            "last_sync_status": None,
42	            "last_sync_error": None,
43	        }
44	    }
45	
46	
47	# CloudFlare credentials may come from the environment (k8s Secrets) instead of

--------------------------------------------------
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: 'KRAWL_CLOUDFLARE_AUTH_TOKEN'
   Severity: Low   Confidence: Medium
   CWE: CWE-259 (https://cwe.mitre.org/data/definitions/259.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b105_hardcoded_password_string.html
   Location: src/webhooks.py:51:4
50	    "account_id": "KRAWL_CLOUDFLARE_ACCOUNT_ID",
51	    "auth_token": "KRAWL_CLOUDFLARE_AUTH_TOKEN",
52	}
53	
54	
55	def _apply_cf_env(data: dict) -> dict:

--------------------------------------------------

Code scanned:
	Total lines of code: 12651
	Total lines skipped (#nosec): 0
	Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 53
		Medium: 1
		High: 0
	Total issues (by confidence):
		Undefined: 0
		Low: 0
		Medium: 6
		High: 48
Files skipped (0):

@github-actions

Copy link
Copy Markdown
Contributor

Ruff — lint & security issues

No issues found.

@BlessedRebuS

Copy link
Copy Markdown
Owner Author

EDIT: after some brainstorming we tought that 25MB of files is too much for a containerized app se we roll back including the Js from the website

@BlessedRebuS
BlessedRebuS deleted the feature/offline-basemap branch August 31, 2026 15:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

frontend Edits the graphic or frontend of Krawl

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant