Automated Security Assessment Infrastructure for LibreHealth EHR Workflows

LibreHealth EHR manages sensitive patient data but currently has no automated security testing or vulnerability detection integrated into its development workflow. This means security issues like SQL injection, cross-site scripting, and broken access control can go undetected during code reviews. This project builds a four-layer automated security assessment pipeline integrated directly into the CI/CD workflow. The pipeline consists of a static analysis stage using PHPStan, Enlightn, and Composer Audit to catch code-level vulnerabilities; a dynamic testing stage using OWASP ZAP to simulate real-world attacks against a running EHR instance; a custom CVSS scoring engine that adjusts risk scores based on PHI sensitivity of the affected data; and a security gate that automatically blocks merge requests when high-severity vulnerabilities are detected. The key deliverables are a Meaningful Use workflow security test suite covering 7 clinical workflows, a fully configured GitLab CI pipeline, an automated security gate with PHI-aware scoring, and per-build HTML, JSON, and CSV security reports for both humans and machines.