fix: address top 10 audit findings across security, correctness, and reliability

- Add Lambda service pseudo-asset to graph so MAY_CREATE_LAMBDA edges
  are no longer silently dropped, restoring Lambda privesc detection
- Add pagination to 6 network/ELB collector methods that were silently
  truncating data in accounts with >100 resources
- Add non-root USER to Dockerfile.mcp to reduce container attack surface
- Log import errors in cli/main.py instead of silently swallowing them
- Validate --terraform-cmd against an allowlist of known binaries to
  prevent command injection via arbitrary binary paths
- Pass IAM Deny statements to resource matching in access edge building
  to eliminate false-positive attack paths
- Raise pydantic floor to >=2.6.3 to avoid CVE-2024-3772 (DoS via URL)
- Treat missing/unresolvable nodes in attack paths as suspicious instead
  of legitimate; replace assert with proper None checks
- Replace bare except Exception in IAM/network collectors with specific
  (ClientError, BotoCoreError) catches and log.warning
- Remove debug print() and dead datetime.utcnow() call from scanner

Author: tsyrulb

.gitignore

@@ -83,6 +83,7 @@ desktop.ini
 .claude/
 .cursor/
 .continue/
+CLAUDE.md
 
 # Debug/temp files
 cyntrisec_v0.1.3_issue_reports

Dockerfile.mcp

@@ -5,4 +5,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates
 WORKDIR /app
 RUN git clone https://github.com/cyntrisec/cyntrisec-cli . && git checkout dd7cce0f6296da1280eb3b4770f361f08d05e555
 RUN python -m pip install --break-system-packages .
+RUN useradd -m -s /bin/bash appuser
+USER appuser
 CMD ["mcp-proxy","python","-m","cyntrisec","serve"]

pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
     "typer>=0.9.0",
     "rich>=13.0",
     "boto3>=1.34",
-    "pydantic>=2.4",
+    "pydantic>=2.6.3",
     "PyYAML>=6.0",
     "mcp>=1.0.0",
 ]

src/cyntrisec/aws/collectors/iam.py

@@ -2,9 +2,13 @@
 
 from __future__ import annotations
 
+import logging
 from typing import Any
 
 import boto3
+from botocore.exceptions import BotoCoreError, ClientError
+
+log = logging.getLogger(__name__)
 
 
 class IamCollector:
@@ -64,7 +68,13 @@ def _collect_inline_role_policies(self, role_name: str) -> list[dict]:
                         RoleName=role_name,
                         PolicyName=policy_name,
                     )
-                except Exception:
+                except (ClientError, BotoCoreError) as e:
+                    log.warning(
+                        "Failed to get inline policy '%s' for role '%s': %s",
+                        policy_name,
+                        role_name,
+                        e,
+                    )
                     continue
                 policies.append(
                     {
@@ -108,7 +118,8 @@ def _get_managed_policy_document(self, policy_arn: str) -> dict | None:
             if isinstance(doc, dict):
                 return dict(doc)
             return {}
-        except Exception:
+        except (ClientError, BotoCoreError) as e:
+            log.warning("Failed to get managed policy document for '%s': %s", policy_arn, e)
             return None
 
     def _collect_instance_profiles(self) -> list[dict]:

src/cyntrisec/aws/collectors/network.py

@@ -2,9 +2,13 @@
 
 from __future__ import annotations
 
+import logging
 from typing import Any
 
 import boto3
+from botocore.exceptions import BotoCoreError, ClientError
+
+log = logging.getLogger(__name__)
 
 
 class NetworkCollector:
@@ -28,14 +32,20 @@ def collect_all(self) -> dict[str, Any]:
         }
 
     def _collect_vpcs(self) -> list[dict]:
-        """Collect VPCs."""
-        response = self._ec2.describe_vpcs()
-        return response.get("Vpcs", [])
+        """Collect VPCs with pagination."""
+        vpcs = []
+        paginator = self._ec2.get_paginator("describe_vpcs")
+        for page in paginator.paginate():
+            vpcs.extend(page.get("Vpcs", []))
+        return vpcs
 
     def _collect_subnets(self) -> list[dict]:
-        """Collect subnets."""
-        response = self._ec2.describe_subnets()
-        return response.get("Subnets", [])
+        """Collect subnets with pagination."""
+        subnets = []
+        paginator = self._ec2.get_paginator("describe_subnets")
+        for page in paginator.paginate():
+            subnets.extend(page.get("Subnets", []))
+        return subnets
 
     def _collect_security_groups(self) -> list[dict]:
         """Collect security groups."""
@@ -46,25 +56,38 @@ def _collect_security_groups(self) -> list[dict]:
         return sgs
 
     def _collect_route_tables(self) -> list[dict]:
-        """Collect route tables."""
-        response = self._ec2.describe_route_tables()
-        return response.get("RouteTables", [])
+        """Collect route tables with pagination."""
+        tables = []
+        paginator = self._ec2.get_paginator("describe_route_tables")
+        for page in paginator.paginate():
+            tables.extend(page.get("RouteTables", []))
+        return tables
 
     def _collect_internet_gateways(self) -> list[dict]:
-        """Collect internet gateways."""
-        response = self._ec2.describe_internet_gateways()
-        return response.get("InternetGateways", [])
+        """Collect internet gateways with pagination."""
+        gateways = []
+        paginator = self._ec2.get_paginator("describe_internet_gateways")
+        for page in paginator.paginate():
+            gateways.extend(page.get("InternetGateways", []))
+        return gateways
 
     def _collect_nat_gateways(self) -> list[dict]:
-        """Collect NAT gateways."""
-        response = self._ec2.describe_nat_gateways()
-        return response.get("NatGateways", [])
+        """Collect NAT gateways with pagination."""
+        gateways = []
+        paginator = self._ec2.get_paginator("describe_nat_gateways")
+        for page in paginator.paginate():
+            gateways.extend(page.get("NatGateways", []))
+        return gateways
 
     def _collect_load_balancers(self) -> list[dict]:
-        """Collect ELBv2 load balancers."""
+        """Collect ELBv2 load balancers with pagination."""
         try:
             elb = self._session.client("elbv2", region_name=self._region)
-            response = elb.describe_load_balancers()
-            return response.get("LoadBalancers", [])
-        except Exception:
+            lbs = []
+            paginator = elb.get_paginator("describe_load_balancers")
+            for page in paginator.paginate():
+                lbs.extend(page.get("LoadBalancers", []))
+            return lbs
+        except (ClientError, BotoCoreError) as e:
+            log.warning("Failed to collect load balancers in %s: %s", self._region, e)
             return []

src/cyntrisec/aws/relationship_builder.py

@@ -540,8 +540,9 @@ def build(self, assets: list[Asset]) -> list[Relationship]:
         Returns:
             List of new relationships to add
         """
-        # Ensure Internet asset exists
+        # Ensure pseudo-assets exist
         self._ensure_internet_asset(assets)
+        self._ensure_lambda_service_asset(assets)
 
         # Build indexes
         self._index_assets(assets)
@@ -597,6 +598,23 @@ def _ensure_internet_asset(self, assets: list[Asset]) -> None:
         )
         assets.append(internet)
 
+    def _ensure_lambda_service_asset(self, assets: list[Asset]) -> None:
+        """Ensure the Lambda service pseudo-asset exists for MAY_CREATE_LAMBDA edges."""
+        lambda_service_id = uuid.UUID("00000000-0000-0000-0000-00000000000a")
+        for asset in assets:
+            if asset.id == lambda_service_id:
+                return
+
+        lambda_service = Asset(
+            id=lambda_service_id,
+            snapshot_id=self._snapshot_id,
+            asset_type="pseudo:lambda-service",
+            aws_resource_id="lambda-service",
+            name="Lambda Service",
+            properties={"description": "AWS Lambda service (target for MAY_CREATE_LAMBDA edges)"},
+        )
+        assets.append(lambda_service)
+
     def _build_network_reachability_relationships(self) -> list[Relationship]:
         """Build CAN_REACH edges based on network accessibility."""
         relationships: list[Relationship] = []
@@ -882,6 +900,7 @@ def _build_iam_access_relationships(self, assets: list[Asset]) -> list[Relations
                 continue
 
             policy_docs = role.properties.get("policy_documents", [])
+            _, denied_resources = self._collect_policy_resources(policy_docs)
 
             for target in sensitive_targets:
                 target_arn = target.arn or target.aws_resource_id
@@ -901,9 +920,11 @@ def _build_iam_access_relationships(self, assets: list[Asset]) -> list[Relations
                         if statement.get("Effect") != "Allow":
                             continue
 
-                        # Check if statement resources match target
+                        # Check if statement resources match target (considering denies)
                         resources = self._normalize_resources(statement.get("Resource"))
-                        if not self._resources_match_target(resources, [], target_arn):
+                        if not self._resources_match_target(
+                            resources, denied_resources, target_arn
+                        ):
                             continue
 
                         # Get matched capabilities from this statement

src/cyntrisec/aws/scanner.py

@@ -89,7 +89,6 @@ def scan(
         Returns:
             Snapshot with scan results
         """
-        datetime.utcnow()
         start_time = time.monotonic()
 
         try:
@@ -112,8 +111,7 @@ def scan(
             account_id = identity["Account"]
             log.info("Connected to AWS account: %s", account_id)
         except Exception as e:
-            # Catch-all for credential/connection errors during init
-            print(f"DEBUG: Caught exception in scanner: {type(e)} {e}")
+            log.debug("Caught exception in scanner: %s %s", type(e).__name__, e)
             raise ConnectionError(f"Failed to authenticate with AWS: {e}") from e
 
         # 2. Initialize storage

src/cyntrisec/cli/main.py

@@ -105,9 +105,11 @@ def version():
     app.command("serve")(serve_cmd)
     app.command("remediate")(remediate_cmd)
     app.command("ask")(ask_cmd)
-except ImportError:
+except ImportError as _import_err:
     # Allow --version and --help to work even if deps missing
-    pass
+    logging.getLogger(__name__).warning(
+        "Failed to register CLI commands (missing dependency?): %s", _import_err
+    )
 
 
 if __name__ == "__main__":

src/cyntrisec/cli/remediate.py

@@ -74,7 +74,7 @@ def remediate_cmd(
     terraform_cmd: str = typer.Option(
         "terraform",
         "--terraform-cmd",
-        help="Terraform binary to invoke when using --execute-terraform",
+        help="Terraform binary name (terraform, tofu, terragrunt)",
     ),
     terraform_include_output: bool = typer.Option(
         False,
@@ -571,12 +571,37 @@ def _decode_bytes(value: object) -> str:
     return str(value)
 
 
+_ALLOWED_TERRAFORM_CMDS = {"terraform", "tofu", "terragrunt", "terraform.exe", "tofu.exe"}
+
+
+def _validate_terraform_cmd(terraform_cmd: str) -> str | None:
+    """Validate terraform_cmd is an allowed basename. Returns error message or None."""
+    import os
+
+    basename = os.path.basename(terraform_cmd)
+    if basename not in _ALLOWED_TERRAFORM_CMDS:
+        return (
+            f"terraform command '{terraform_cmd}' is not in the allowed list: "
+            f"{', '.join(sorted(_ALLOWED_TERRAFORM_CMDS))}. "
+            "Use a bare command name (e.g. 'terraform' or 'tofu')."
+        )
+    if terraform_cmd != basename:
+        return (
+            f"terraform command must be a bare name, not a path: '{terraform_cmd}'. "
+            "Use 'terraform' or 'tofu' instead."
+        )
+    return None
+
+
 def _run_terraform(terraform_cmd: str, tf_dir: str, *, include_output: bool = False) -> dict:
     """
     Run terraform apply -auto-approve against the generated hints.
 
     Returns a dict with command and status. If terraform is missing, returns error.
     """
+    validation_err = _validate_terraform_cmd(terraform_cmd)
+    if validation_err:
+        return {"ok": False, "error": validation_err}
     if not shutil.which(terraform_cmd):
         return {"ok": False, "error": f"terraform command '{terraform_cmd}' not found"}
 
@@ -614,6 +639,9 @@ def _run_terraform_plan(terraform_cmd: str, tf_dir: str, *, include_output: bool
     """
     Run terraform plan (no apply) to validate generated module.
     """
+    validation_err = _validate_terraform_cmd(terraform_cmd)
+    if validation_err:
+        return {"ok": False, "error": validation_err, "exit_code": None}
     if not shutil.which(terraform_cmd):
         return {
             "ok": False,

src/cyntrisec/core/business_logic.py

@@ -77,7 +77,8 @@ def compute_delta(self, attack_paths: list[AttackPath]) -> list[AttackPath]:
 
     def _is_entrypoint(self, asset: Asset) -> bool:
         """Check if asset matches entrypoint criteria."""
-        assert self.config is not None
+        if self.config is None:
+            return False
         criteria = self.config.entrypoints
 
         # By ID
@@ -98,7 +99,8 @@ def _is_entrypoint(self, asset: Asset) -> bool:
 
     def _matches_allowlist(self, asset: Asset) -> bool:
         """Check if asset matches global allowlist tags."""
-        assert self.config is not None
+        if self.config is None:
+            return False
         for tag_key, tag_pattern in self.config.global_allowlist.items():
             val = asset.tags.get(tag_key)
             if val and fnmatch.fnmatch(val, tag_pattern):
@@ -122,11 +124,8 @@ def _is_path_legitimate(self, path: AttackPath) -> bool:
         for asset_id in path.path_asset_ids:
             asset = self.graph.asset(asset_id)
             if not asset:
-                continue
-
-            # If any node in the chain is NOT business-required, the path is suspect.
-            # Exception: Maybe we allow traversal through unmarked nodes if the flow itself is marked?
-            # That requires Critical Flow labeling (Edge labeling).
+                # Missing/unresolvable nodes are suspicious, not legitimate
+                return False
 
             if self.LABEL_BUSINESS not in asset.labels:
                 return False