$ show DefectDojo/django-DefectDojo
DefectDojo is a Django-based vulnerability management platform that aggregates, deduplicates, and tracks security findings from over 200 security scanners (SAST, DAST, SCA, container, cloud, infrastructure). The system ingests scan reports via a standardized parser interface, normalizes findings into a core data model (Product, Engagement, Test, Finding, Location), and provides advanced features such as risk-based prioritization, SLA management, JIRA/GitHub integration, notifications (Slack, Teams, email), role-based access control, and customizable reporting. The architecture is a Django monolith with a REST API (v2 using DRF, v3 using Ninja in alpha), Celery for async task processing (imports, deduplication, JIRA sync, SLA expiry), PostgreSQL with full-text search and audit logging via pghistory, and a containerized deployment with Docker Compose. Key entry points include the parser factory (dojo/tools/factory.py), API viewsets, and management commands. The codebase demonstrates strong software engineering patterns such as a modular parser contract, an abstract location manager for feature-flag-driven migration, and an authorization filter registry, but carries technical debt from a dual API surface and an incomplete migration to a new location model.
The LLM identified 5 files worth highlighting for reuse:
Dynamically discovers and registers scanner parsers by scanning the dojo/tools directory. Each parser module implements a consistent interface (get_scan_types, get_findings, etc.), enabling pluggable support for hundreds of security tools. The factory is decoupled from individual parser logic and can be reused in any project needing a plugin-based import system.
Implements a modular authorization filter registry where permission-scoping functions are registered per model. This avoids hardcoded permission checks and allows new models to opt into fine-grained RBAC by registering a filter function. The pattern is reusable for any Django app requiring extensible authorization scoping.
Defines the BaseLocationManager abstract class and LocationHandler facade to abstract over the legacy Endpoint model and the new Location model, controlled by a feature flag. This pattern cleanly isolates the transition between two data models and can be adapted for other migration scenarios where parallel implementations must coexist without code duplication.
Provides a custom HTTP session with SSRF protection by validating IP addresses against private/subnet ranges and enforcing a whitelist/deny-list. Overrides urllib3 and requests connection classes to prevent server-side request forgery. This is a self-contained security utility that can be extracted into any Python project needing safe outbound HTTP.
Implements a per-request (or per-Celery-task) in-memory cache using thread-local storage. Provides @cache_for_request and @cache_for_request_or_task decorators to memoize function results within the same request/task lifecycle. This lightweight caching pattern reduces redundant database queries and is easily reusable in any Django/Celery project.