### Start development server with hot reloading

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/README.md

Commands to perform a fresh install and start the development server from the docs directory.

```bash
rm -rf public node_modules
npm install
npm run dev
```

```bash
rm -rf public node_modules && \
npm install && \
npm run dev
```

--------------------------------

### Start MySQL service

Source: https://github.com/defectdojo/django-defectdojo/wiki/DefectDojo-Installation-Guide-Ubuntu-Desktop-16.04.2

Starts the MySQL service after installation.

```bash
sudo service mysql start
```

--------------------------------

### Run setup.bash script

Source: https://github.com/defectdojo/django-defectdojo/wiki/DefectDojo-Installation-Guide-Ubuntu-Desktop-16.04.2

Executes the setup.bash script which installs OS packages, prompts for database info, installs Python packages, and runs migrations.

```bash
./setup.bash
```

--------------------------------

### GET /api/v2/ai_governance/verdicts/

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/triage_findings/findings_workflows/PRO__ai_governance_policies.md

Retrieves verdicts for AI governance decisions, filtered by product and decision type. Example: GET /api/v2/ai_governance/verdicts/?product=12&decision=unauthorized

```APIDOC
## GET /api/v2/ai_governance/verdicts/

### Description
Retrieves verdicts for AI governance decisions, filtered by product and decision type.

### Method
GET

### Endpoint
/api/v2/ai_governance/verdicts/

### Parameters
#### Query Parameters
- **product** (integer) - Required - Product ID to filter verdicts
- **decision** (string) - Required - Decision type (e.g., unauthorized)

### Response
#### Success Response (200)
- List of verdicts

#### Response Example
(No example provided in source)
```

--------------------------------

### Install dojo-helm-cli binary

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/get_started/pro/onprem/kubernetes/installing_with_dojo_helm_cli.md

Extracts the archive and moves the binary to /usr/local/bin, then verifies the installation with --version.

```bash
tar -xzvf dojo-helm-cli_*.tar.gz
sudo mv dojo-helm-cli /usr/local/bin/
dojo-helm-cli --version
```

--------------------------------

### finding_summary example: severity spread for internet-facing tag

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/metrics_reports/ai/mcp_server_pro.md

Example LLM call to `finding_summary` with a `tags` filter to get severity spread for findings tagged `internet-facing`.

```javascript
finding_summary({
  tags: ["internet-facing"]
})
```

--------------------------------

### Initialize local workspace for upgrade

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/get_started/pro/onprem/kubernetes/upgrading_on_kubernetes.md

Set up a temporary directory to store configuration files and certificates for the upgrade process.

```bash
RELEASE=dojopro
WORK=$(mktemp -d)
```

--------------------------------

### finding_summary example: severity breakdown for payments product

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/metrics_reports/ai/mcp_server_pro.md

Example LLM call to `finding_summary` with `product_id` and `date` filter to get a severity breakdown for the last quarter.

```javascript
finding_summary({
  product_id: 42,
  date: ["4 - Past 90 days"]
})
```

--------------------------------

### Install PostgreSQL client and test database connection

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/get_started/pro/onprem/docker_compose/installing_on_docker_compose.md

Run these commands to install the PostgreSQL client tools and connect to the database. Replace <db-host> with your database host. The -W flag prompts for a password.

```bash
sudo apt update
sudo apt -y install postgresql-client-common postgresql-client-16
psql -h <db-host> -p 5432 -d dojodb -U dojodbusr -W
```

--------------------------------

### API request to get code issues

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/supported_tools/parsers/file/snyk_issue_api.md

Example GET request to the Snyk Issue API to retrieve only code issues. Replace {org_id} with your organization ID. The version parameter is set to 2025-08-02.

```http
GET https://api.snyk.io/rest/orgs/{org_id}/issues?version=2025-08-02&type=code
```

--------------------------------

### Clone and Start Minikube

Source: https://github.com/defectdojo/django-defectdojo/blob/master/helm/defectdojo/README.md

Initial steps to clone the repository and start the Minikube environment with ingress enabled.

```zsh
git clone https://github.com/DefectDojo/django-DefectDojo
cd django-DefectDojo

minikube start
minikube addons enable ingress
```

--------------------------------

### Add user to docker group and verify Docker

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/get_started/pro/onprem/docker_compose/installing_on_docker_compose.md

After installing Docker Engine, add your user to the docker group and start a new group session. The docker info command verifies the installation and permissions.

```bash
sudo usermod -aG docker "$USER"
newgrp docker
docker info
```

--------------------------------

### Quick Start with Docker Compose

Source: https://github.com/defectdojo/django-defectdojo/blob/master/README.md

Clones the DefectDojo repository and starts the application using Docker Compose.

```sh
git clone https://github.com/DefectDojo/django-DefectDojo && cd django-DefectDojo && docker compose up
```

--------------------------------

### Good example: use get with default

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/get_started/contributing/how-to-write-a-parser.md

Use dict.get() with a default value to safely access optional fields.

```python
   finding.cwe = data.get("mykey", 123)
```

--------------------------------

### Get namespace supplemental groups range for fsGroup

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/get_started/pro/onprem/kubernetes/openshift_deployment.md

Use this command to read the start of the namespace's supplemental groups range, which is required as the fsGroup value when using NFS or EFS storage. The annotation is formatted as a start value and length; use the start value. This is only needed for NFS/EFS, not for the default PersistentVolumeClaim path.

```bash
oc get namespace <namespace> \
  -o jsonpath='{.metadata.annotations.openshift\.io/sa\.scc\.supplemental-groups}'
```

--------------------------------

### 运行 makemigrations 创建迁移文件

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/get_started/contributing/how-to-write-a-parser.zh-hans.md

在修改 dojo/models.py 后，使用此命令在 dojo/db_migrations 中生成新的迁移文件。该命令在 Docker 容器中执行，需要先启动 uwsgi 服务。

```bash
$ docker compose exec uwsgi bash -c 'python manage.py makemigrations -v2'
```

--------------------------------

### Example psql session

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/releases/pro/ddorch-database.md

A transcript of the commands used to create and configure the database.

```text
root@dbserver:~# sudo -i -u postgres psql --username postgres
psql (16.8)
Type "help" for help.

postgres=# CREATE DATABASE "dojodb-ddorch";
CREATE DATABASE
postgres=# GRANT ALL PRIVILEGES ON DATABASE "dojodb-ddorch" TO dojodbusr;
GRANT
postgres=# ALTER DATABASE "dojodb-ddorch" OWNER TO dojodbusr;
ALTER DATABASE
postgres=# \q
```

--------------------------------

### Noncompliant Code Example: Path Traversal via User Input

Source: https://github.com/defectdojo/django-defectdojo/blob/master/unittests/scans/sonarqube/sonar-6-findings.html

This example shows a path traversal vulnerability where user-controlled GET parameters are used directly in a file path. The unlink call is flagged as noncompliant because the path is constructed from tainted data.

```PHP
$userId = $_GET["userId"];
$fileUUID = $_GET["fileUUID"];

if ( $_SESSION["userId"] == $userId ) {
  unlink("/storage/" . $userId . "/" . $fileUUID); // Noncompliant
}
```

--------------------------------

### Python example to query /users endpoint with API key

Source: https://github.com/defectdojo/django-defectdojo/blob/master/dojo/templates/dojo/api_v2_key.html

A simple Python example using the requests library to make a GET request to the /users endpoint with the API key in the Authorization header. Set verify to False if the SSL certificate is self-signed.

```python
import requests

url = '{% if request.is_secure %}https{% else %}http{% endif %}://{{ request.META.HTTP_HOST }}/api/v2/users/'
headers = {'content-type': 'application/json',
           'Authorization': 'Token {{ key.key }}'}
r = requests.get(url, headers=headers, verify=True) # set verify to False if ssl cert is self-signed

for key, value in r.__dict__.items():
  print(f"'{key}': '{value}'")
  print('------------------')
```

--------------------------------

### Build a sample Android application for testing

Source: https://github.com/defectdojo/django-defectdojo/blob/master/docs/content/supported_tools/parsers/file/apkleaks.md

Commands to compile and sign a small Android application using the Android SDK build-tools to generate test APKs.

```bash
aapt2 compile --dir res -o res.zip
aapt2 link -o base.apk -I "$ANDROID_HOME/platforms/android-34/android.jar" \
  --manifest AndroidManifest.xml res.zip
javac -d classes -classpath "$ANDROID_HOME/platforms/android-34/android.jar" MainActivity.java
d8 --output . classes/com/example/genericapp/*.class
zip -j base.apk classes.dex
zipalign -f 4 base.apk aligned.apk
apksigner sign --ks debug.jks --out generic-app.apk aligned.apk
```