chore(deps)(deps): bump beautifulsoup4 from 4.12.3 to 4.14.3

.dockerignore

@@ -0,0 +1,62 @@
+# Docker ignore file - exclude unnecessary files from build context
+
+# Data and databases
+data/
+*.lancedb/
+*.log
+logs/
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+*.egg-info/
+dist/
+build/
+
+# Virtual environments
+venv/
+env/
+.venv/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Git
+.git/
+.gitignore
+.gitattributes
+
+# Environment
+.env
+.env.local
+
+# Documentation (not needed in container)
+README.md
+SECURITY.md
+docs/
+
+# Testing
+tests/
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Development dependencies
+requirements-dev.txt
+
+# Docker
+Dockerfile
+docker-compose.yml
+.dockerignore
+
+# CI/CD
+.github/
+.gitlab-ci.yml

.env.example

@@ -3,7 +3,7 @@
 
 # GitHub Repository
 GITHUB_REPO_OWNER=edward-playground
-GITHUB_REPO_NAME=aidefend-framework
+GITHUB_REPO_NAME=aidefense-framework
 GITHUB_BRANCH=main
 GITHUB_TACTICS_PATH=tactics
 
@@ -15,15 +15,66 @@ ENABLE_AUTO_SYNC=true
 # API Configuration
 API_HOST=127.0.0.1
 API_PORT=8000
+
+# ⚠️ IMPORTANT: Multi-worker mode is NOT supported
+# The sync architecture requires a single worker process.
+# Setting API_WORKERS > 1 will cause sync conflicts and stale data issues.
+# Keep this value at 1 for correct operation.
 API_WORKERS=1
 
 # Security
-MAX_QUERY_LENGTH=2000
+# MAX_QUERY_LENGTH set to 1500 to align with bge-small-en-v1.5 model's 512 token limit
+# (1500 chars ≈ 375 tokens with 4:1 ratio, leaving buffer for system overhead)
+MAX_QUERY_LENGTH=1500
 MAX_TOP_K=20
 DEFAULT_TOP_K=5
 ENABLE_RATE_LIMITING=true
 RATE_LIMIT_PER_MINUTE=60
 
+# Chunked Query Configuration (for long text processing)
+# Enables automatic chunking for queries exceeding MAX_QUERY_LENGTH
+# Conservative defaults (5000 chars, 5 chunks) balance functionality with security
+#
+# MAX_TOTAL_QUERY_LENGTH: Maximum total query length (default: 5000 chars)
+#   - Queries > MAX_QUERY_LENGTH are automatically chunked
+#   - Each chunk is searched independently, results are combined
+#   - Use case: Long vulnerability reports, security documents
+#   - Security: Prevents DoS via excessive input size
+# MAX_CHUNKS: Maximum number of chunks per query (default: 5)
+#   - Limits computational overhead
+#   - 5 chunks × 1200 chars = ~6000 chars effective capacity
+#   - Security: Prevents DoS via excessive chunk count
+# MAX_CHUNKS_PROCESSING_TIME: Timeout for chunked queries (default: 15 seconds)
+#   - Prevents long-running queries from blocking the service
+#   - Security: Timeout protection against resource exhaustion
+#
+# Example: A 3000-character security report will be split into ~3 chunks,
+# searched separately, and results will be deduplicated and ranked.
+#
+# MAX_TOTAL_QUERY_LENGTH=5000
+# MAX_CHUNKS=5
+# MAX_CHUNKS_PROCESSING_TIME=15
+# CHUNK_SIZE=1200
+# CHUNK_OVERLAP=200
+
+# Authentication (REST API only - MCP mode uses file permissions)
+# AUTH_MODE options:
+#   - "no_auth" (default): No authentication required
+#       ✓ Suitable for: Local development, personal use on localhost
+#       ✗ NOT suitable for: Production deployment, public networks
+#   - "api_key": Require API key in X-API-Key header
+#       ✓ Suitable for: Production deployment, team collaboration, CI/CD
+#       ⚠️ Requires: AIDEFEND_API_KEY to be set
+#
+# To enable API key authentication:
+#   1. Uncomment AUTH_MODE and set to "api_key"
+#   2. Generate key: python scripts/generate_api_key.py
+#   3. Uncomment AIDEFEND_API_KEY and paste the generated key
+#   4. Restart the service
+#
+# AUTH_MODE=no_auth
+# AIDEFEND_API_KEY=<paste-your-generated-api-key-here>
+
 # CORS
 ENABLE_CORS=true
 # CORS_ORIGINS=["http://localhost:*","https://localhost:*"]
@@ -40,6 +91,12 @@ ENABLE_FILE_LOGGING=true
 # LOG_PATH=./data/logs/aidefend_mcp.log
 
 # Advanced: Embedding model (uses FastEmbed with ONNX Runtime)
-# Default: BAAI/bge-small-en-v1.5 (lightweight, fast, 384-dim)
-# Alternative: sentence-transformers/all-MiniLM-L6-v2 (also supported)
-# EMBEDDING_MODEL=BAAI/bge-small-en-v1.5
+# Default: Xenova/multilingual-e5-base (Microsoft, multilingual, 768-dim, 512 tokens, 100+ languages)
+# - Model size: ~265 MB (int8 quantized), supports cross-language semantic search
+# - Allows users to query in any language (e.g., Chinese, Japanese) and match English content
+# Alternative options:
+# - intfloat/multilingual-e5-small: Smaller (113 MB), 384-dim, good performance
+# - sentence-transformers/paraphrase-multilingual-MiniLM-L12-v2: 220 MB, 384-dim, 50+ languages
+# Embedding Configuration
+EMBEDDING_MODEL=Xenova/multilingual-e5-base
+EMBEDDING_DIMENSION=768

.github/dependabot.yml

@@ -0,0 +1,46 @@
+version: 2
+updates:
+  # Python dependencies
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "python"
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    # Group minor and patch updates together
+    groups:
+      dev-dependencies:
+        patterns:
+          - "pytest*"
+          - "black"
+          - "flake8"
+          - "mypy"
+          - "bandit"
+          - "safety"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore(ci)"
+      include: "scope"

.github/workflows/security.yml

@@ -0,0 +1,95 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [ main, develop ]
+  pull_request:
+    branches: [ main, develop ]
+  schedule:
+    # Run weekly on Monday at 00:00 UTC
+    - cron: '0 0 * * 1'
+  workflow_dispatch:  # Allow manual trigger
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  bandit:
+    name: Bandit Security Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install Bandit
+        run: pip install bandit[toml]
+
+      - name: Run Bandit security scan
+        run: |
+          bandit -r app/ -f json -o bandit-report.json || true
+          bandit -r app/ -f screen
+        continue-on-error: true
+
+      - name: Upload Bandit results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: bandit-report
+          path: bandit-report.json
+
+  safety:
+    name: Safety Dependency Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install Safety
+        run: pip install safety
+
+      - name: Check dependencies with Safety
+        run: |
+          safety check -r requirements.txt --json > safety-report.json || true
+          safety check -r requirements.txt
+        continue-on-error: true
+
+      - name: Upload Safety results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: safety-report
+          path: safety-report.json
+
+  codeql:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+
+    permissions:
+      actions: read   
+      contents: read  
+      security-events: write 
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: python
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.gitignore

@@ -1,3 +1,11 @@
+# Node.js
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+*.tgz
+package-lock.7z
+
 # Python
 __pycache__/
 *.py[cod]
@@ -52,6 +60,7 @@ data/
 # Testing
 .pytest_cache/
 .coverage
+coverage.xml
 htmlcov/
 .tox/
 .hypothesis/
@@ -67,8 +76,8 @@ dmypy.json
 # Distribution / packaging
 *.whl
 
-# Docker
-*.dockerignore
+# Docker volumes and runtime data
+docker-compose.override.yml
 
 # Logs
 logs/
@@ -80,4 +89,38 @@ temp/
 tmp/
 
 # VSCode Claude extension cache
-.claude/
+.claude/
+
+# Claude temporary output files (but keep official CLAUDE.md)
+CLAUDE_TEMP*.md
+CLAUDE_OUTPUT*.md
+UPGRADE*.md
+UPDATE*.md
+*UPDATE*REPORT*.md
+!CLAUDE.md
+
+# Test and verification scripts (keep these for documentation)
+# tests/fixtures/test_example.js - Example file for parser testing
+
+# Temporary diagnostic/troubleshooting scripts (created during development)
+scripts/diagnose_*.py
+scripts/compare_*.py
+scripts/find_*.py
+scripts/check_*.py
+scripts/test_*.py
+
+# Security: Sensitive files that must NEVER be committed
+# These patterns are critical for security
+.env
+.env.*
+!.env.example
+*.key
+*.pem
+*.p12
+*_secret*
+*_private*
+credentials*.json
+secrets*.json
+
+# Windows command error artifacts
+nul