From 164b19cdb85ad56f4e131e32813614ebbcc1f91c Mon Sep 17 00:00:00 2001
From: Do Siki <dosiki852@gmail.com>
Date: Sat, 22 Aug 2026 14:33:06 +0200
Subject: [PATCH] fix(security): filter docker exec errors and include finding
 details in ntfy body

- a container stopping mid-scan produced 'cannot exec in a stopped state'
  as a false-positive finding; such exec errors are now filtered out
- the ntfy notification body now carries the actual alert lines, not just
  a counter
---
 scripts/security-scan.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/scripts/security-scan.sh b/scripts/security-scan.sh
index 5936fc6..e99bbfc 100755
--- a/scripts/security-scan.sh
+++ b/scripts/security-scan.sh
@@ -28,17 +28,20 @@ alert() {
 }
 
 # ntfy push — a helyi ntfy szerverre (127.0.0.1:2586), az si_17t_pro user
-# tokenjével (a credential fájlból, sosem kerül kimenetre).
+# tokenjével (a credential fájlból, sosem kerül kimenetre). A body a konkrét
+# találatokat is tartalmazza, ne csak egy számlálót.
 notify() {
   [ -f "$NTFY_CRED" ] || return 0
   local token
   token="$(grep '^NTFY_SI_TOKEN=' "$NTFY_CRED" 2>/dev/null | cut -d= -f2- | tr -d '"' | tr -d '[:space:]')"
   [ -n "$token" ] || return 0
+  local body
+  body="🛡 mozdIT monitoring: ${FINDINGS} eltérés — $(date '+%F %T')\n${ALERTS}"
   curl -s -o /dev/null --max-time 10 \
     -H "Authorization: Bearer $token" \
     -H "Title: mozdIT biztonsági riasztás" \
     -H "Priority: high" \
-    -d "🛡 mozdIT monitoring: ${FINDINGS} eltérés — $(date '+%F %T')" \
+    -d "$body" \
     "$NTFY_URL/$NTFY_TOPIC" || true
 }
 
@@ -62,7 +65,7 @@ for cid in $(docker ps -q 2>/dev/null); do
   fi
   [ -n "$decoys" ] && alert "container $name decoy: $(printf '%s' "$decoys" | tr '\n' ' ')"
 
-  arts="$(docker exec "$cid" sh -c 'ls /tmp/.kworkerd /tmp/.redis-server.pid 2>/dev/null' 2>/dev/null || true)"
+  arts="$(docker exec "$cid" sh -c 'ls /tmp/.kworkerd /tmp/.redis-server.pid 2>/dev/null' 2>&1 | grep -vE 'cannot exec|is not running|No such container|Error response' || true)"
   [ -n "$arts" ] && alert "container $name /tmp artifacts: $(printf '%s ' $arts)"
 done