Add CLI security review app for Chrome and WhatsApp

[umakarem82]

Motivation

• Provide a lightweight, repeatable CLI tool to perform quick security reviews of Chrome extensions and WhatsApp integrations.

Description

• Add security_review_app.py, a CLI questionnaire that contains targeted control sets under REVIEW_QUESTIONS for chrome and whatsapp.
• Implement interactive prompting via ask_boolean, weighted scoring, and a grade function that maps scores to LOW RISK/MODERATE RISK/HIGH RISK.
• Support both human-readable summary output and machine-readable output via --json which emits a structured report object.

Testing

• Ran python3 -m py_compile security_review_app.py and the file compiled without errors.
• Ran python3 security_review_app.py --help and the CLI printed the expected usage/help text.

---

Codex Task

---

Note

Low Risk
Adds a standalone CLI script with interactive input and JSON output; no existing production logic is modified. Risk is low, mainly around usability/maintainability of the questionnaire/scoring thresholds.

Overview
Introduces security_review_app.py, a standalone interactive CLI questionnaire for Chrome extensions and WhatsApp integrations with weighted questions and a simple score-to-risk grading (LOW/MODERATE/HIGH).

Supports both a terminal summary and a --json mode that emits a structured report including score, risk rating, and passed/failed controls.

^{Reviewed by Cursor Bugbot for commit 2071da7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2071da7. Configure here.}

[cursor]

JSON output polluted by stdout print statements

High Severity

When --json is used, the print() on line 76 ("Security Review: ...") and the print("Please enter y or n.") in ask_boolean both write to stdout before the JSON blob is emitted. This makes the --json output invalid — any downstream tool parsing stdout as JSON will fail. The header print is unconditionally called regardless of the --json flag, and the retry prompt in ask_boolean also goes to stdout.

Additional Locations (1)

• security_review_app.py#L54-L55

 

^{Reviewed by Cursor Bugbot for commit 2071da7. Configure here.}