Usage Guide

You: "Write a user authentication function in Python"

AI: [Generates code and automatically scans it with scan_code]

AI: "I've created an authentication function with bcrypt password
     hashing and rate limiting. The compliance scan found 0 violations
     - the code meets OWASP and GDPR standards!"

You: "Scan all files in the /api directory for compliance issues"

AI: [Uses batch_scan to check all files at once]

AI: "I've scanned 12 files in /api. Found 3 violations:
     - auth.py line 45: Weak password hashing
     - users.py line 23: SQL injection risk
     - config.py line 10: Hardcoded credentials"

You: "What compliance standards are you checking against?"

AI: [Calls get_config]

AI: "Currently enforcing:
      OWASP Top 10
      GDPR
      HIPAA
      PCI-DSS
      SOC 2
      ISO 27001
     And 9 more standards..."

You: "What OWASP rules do you check?"

AI: [Calls get_rules with filter for OWASP]

AI: "Checking 127 OWASP rules including:
     - A01:2021 - Broken Access Control
     - A02:2021 - Cryptographic Failures
     - A03:2021 - Injection
     [full list...]"

You: "Is AIVory Guard working?"

AI: [Calls health_check]

AI: " AIVory Guard is healthy
     - Backend: app.aivory.net
     - Latency: 45ms
     - Status: All systems operational"

You: "Create a REST API endpoint for password reset"

AI: [Generates code with security best practices]
    [Automatically scans with scan_code]
    [Reports results]

You: "Scan this authentication module for HIPAA violations:
     [paste code]"

AI: [Uses scan_code to check the provided code]
    [Lists violations and suggests fixes]

You: "Create a secure login endpoint"

AI: [Generates initial code]
    [Scans and finds 2 violations]
    [Fixes the violations]
    [Re-scans to verify]

AI: "Created login endpoint. Fixed 2 security issues:
     1. Added rate limiting
     2. Upgraded to bcrypt password hashing
     Final scan: 0 violations "

You: "Scan my entire /src directory for PCI-DSS compliance"

AI: [Uses batch_scan on all project files]
    [Generates compliance report]

AI: "Scanned 47 files. Summary:
      42 files compliant
      5 files with violations (18 total violations)

     Critical issues:
     - payment.js: Unencrypted card data storage
     - api.js: Missing input validation
     [detailed breakdown...]"

{
  "status": "completed",
  "violations": [
    {
      "severity": "high",
      "standard": "OWASP",
      "rule": "A02:2021 - Cryptographic Failures",
      "message": "Weak password hashing algorithm detected",
      "line": 23,
      "column": 12,
      "suggestion": "Use bcrypt, Argon2, or PBKDF2 for password hashing"
    }
  ],
  "summary": {
    "total_violations": 1,
    "critical": 0,
    "high": 1,
    "medium": 0,
    "low": 0
  }
}

You: "Create a user registration function"
AI: [Generates and immediately scans]

You: "Create a user registration function"
     [Later...] "Now scan the entire codebase"

You: "Create a patient records API that meets HIPAA requirements"
AI: [Focuses on HIPAA-specific violations]

You: "Create a patient records API"
AI: [Checks all standards, may miss HIPAA-specific issues]

You: "Generate a login function and fix any violations found"
AI: [Generates, scans, fixes, re-scans automatically]

You: "Generate a login function"
     "What violations did you find?"
     "Now fix them"
     "Scan again"

You: "Scan all files in /api for compliance"
AI: [Uses batch_scan for all files at once]

You: "Scan auth.py"
     "Scan users.py"
     "Scan config.py"
     [etc...]

You: Create a REST API endpoint for credit card processing that
     meets PCI-DSS requirements

AI: I'll create a secure credit card processing endpoint.

    [Generates code with:
     - TLS/SSL enforcement
     - Card data encryption at rest
     - Tokenization
     - Audit logging
     - Input validation]

    Let me scan this for PCI-DSS compliance...

     Scan complete: 0 violations found

    The endpoint meets all PCI-DSS requirements:
    - Card data is encrypted (AES-256)
    - Uses tokenization to avoid storing raw card numbers
    - TLS 1.2+ enforced for all connections
    - Comprehensive audit logging
    - Strong input validation

You: Design a patient database schema that's HIPAA compliant

AI: I'll create a HIPAA-compliant patient database schema.

    [Generates schema with:
     - Field-level encryption for PHI
     - Access control tables
     - Audit trail tables
     - Data retention policies]

    Scanning for HIPAA compliance...

    Found 1 medium severity issue:
    - Missing automatic encryption for email field

    Let me fix that...

     Fixed: Added encryption to email field
     Re-scan: 0 violations

    The schema now fully meets HIPAA requirements for
    Protected Health Information (PHI) storage.

You: Audit my authentication module for security issues

AI: I'll scan your authentication module for security vulnerabilities.

    Scanning auth.py...

    Found 3 violations:

    HIGH - Line 45: Weak password hashing
     Using MD5 for passwords
     Recommendation: Migrate to bcrypt or Argon2

    MEDIUM - Line 67: No rate limiting
     Login endpoint vulnerable to brute force
     Recommendation: Add rate limiting (5 attempts per minute)

    LOW - Line 89: Verbose error messages
     Error messages reveal user existence
     Recommendation: Use generic error messages

    Would you like me to fix these issues?