Compliance Attestation Report

Dependency audit reported vulnerable packages.

Engine

Security

Evidence

{ "tool": "pnpm audit", "output": "{\n \"actions\": [],\n \"advisories\": {\n \"1101438\": {\n \"findings\": [\n {\n \"version\": \"14.2.16\",\n \"paths\": [\n \".>next\"\n ]\n }\n ],\n \"found_by\": null,\n \"deleted\": null,\n \"references\": \"- https://github.com/vercel/next.js/security/advisories/GHSA-7m27-7ghc-44w9\\n- https://nvd.nist.gov/vuln/detail/CVE-2024-56332\\n- https://github.com/advisories/GHSA-7m27-7ghc-44w9\",\n \"created\": \"2025-01-03T20:19:29.000Z\",\n \"id\": 1101438,\n \"npm_advisory_id\": null,\n \"overview\": \"### Impact\\nA Denial of Service (DoS) attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution.\\n\\n_Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time._\\n\\nDe

Recommendation

Upgrade vulnerable dependencies, pin safe versions, and re-run dependency audit.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Build failed with compilation or runtime build errors.

Engine

Quality

Evidence

{ "output": "> schedula-project@0.1.0 build C:\\Users\\Sunny\\Downloads\\Engineering-validation-platform\\uploaded-repositories\\github-achieveradarsh-schedula-app-model-main-409f78b6\n> next build\n\n ▲ Next.js 14.2.16 (turbo)\n\n Creating an optimized production build ...\n ELIFECYCLE  Command failed with exit code 1.\n\n ⚠ You are using a non-standard \"NODE_ENV\" value in your environment. This creates inconsistencies in the project and is strongly advised against. Read more: https://nextjs.org/docs/messages/non-standard-node-env\n\n> Build error occurred\nError: next build doesn't support turbopack yet\n at turbopackBuild (C:\\Users\\Sunny\\Downloads\\Engineering-validation-platform\\uploaded-repositories\\github-achieveradarsh-schedula-app-model-main-409f78b6\\node_modules\\.pnpm\\next@14.2.16_react-dom@18.3.1_react@18.3.1__react@18.3.1\\node_modules\\next\\src\\build\\index.ts:1343:17)\n at <anonymous> (C:\\Users\\Sunny\\Downloads\\Engineering-validation-platform\\uploaded-repositories\\github-achieveradarsh-schedula-app-model-main-409f78b6\\node_modules\\.pnpm\\next@14.2.16_react-dom@18.3.1_react@18.3.1__react@18.3.1\\n

Recommendation

Fix build failures before production release and add the build command to CI gates.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Lint script failed. TypeScript compiler reported errors. Fallback static scan found elevated smell, any-type, or duplicate-symbol counts.

Engine

Quality

Evidence

{ "lint": "> schedula-project@0.1.0 lint C:\\Users\\Sunny\\Downloads\\Engineering-validation-platform\\uploaded-repositories\\github-achieveradarsh-schedula-app-model-main-409f78b6\n> next lint\n\n? How would you like to configure ESLint? https://nextjs.org/docs/basic-features/eslint\n\u001b[?25l❯ Strict (recommended)\n Base\n Cancel ELIFECYCLE  Command failed with exit code 1.\n\n ⚠ If you set up ESLint yourself, we recommend adding the Next.js ESLint plugin. See https://nextjs.org/docs/basic-features/eslint#migrating-existing-config", "staticScan": { "scannedFiles": 106, "codeSmellCount": 13, "unsafeAnyCount": 65, "duplicatedSymbolCount": 126 }, "typescript": "app/doctor/calendar/page.tsx(7,76): error TS7016: Could not find a declaration file for module 'react-big-calendar'. 'C:/Users/Sunny/Downloads/Engineering-validation-platform/uploaded-repositories/github-achieveradarsh-schedula-app-model-main-409f78b6/node_modules/.pnpm/react-big-calendar@1.20.0_r_a515fc9d64452ab63fd67ca4ce84daf0/node_modules/react-big-calendar/lib/index.js' implicitly has

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No runnable test script was found for Jest, Vitest, Playwright, Cypress, or coverage.

Engine

Quality

Evidence

{ "availableScripts": [ "build", "dev", "lint", "start" ] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Fallback SAST scan found high-risk code patterns.

Engine

Security

Evidence

{ "findings": [ { "name": "Unsafe eval", "count": 0, "severity": "high" }, { "name": "Command execution", "count": 0, "severity": "high" }, { "name": "SQL string construction", "count": 22, "severity": "high" }, { "name": "Weak crypto", "count": 0, "severity": "medium" }, { "name": "Prototype pollution sink", "count": 0, "severity": "medium" }, { "name": "Path traversal risk", "count": 0, "severity": "medium" } ], "scannedFiles": 104 }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Fallback secret scan did not find known secret patterns.

Engine

Security

Evidence

{ "envFiles": [], "findings": [ { "name": "AWS access key", "count": 0 }, { "name": "OpenAI key", "count": 0 }, { "name": "Private key", "count": 0 }, { "name": "JWT", "count": 0 }, { "name": "Generic secret assignment", "count": 0 } ], "scannedFiles": 110, "includeGitHistory": false }

Recommendation

Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Custom web security rules found missing or undiscovered controls.

Engine

Security

Evidence

{ "hasCsp": false, "missing": [ "hasCsp", "hasCorsConfig", "hasCsrfToken", "hasRateLimit", "hasSecureCookie" ], "hasCsrfToken": false, "hasRateLimit": false, "scannedFiles": 109, "hasCorsConfig": false, "hasAuthzChecks": true, "hasSecureCookie": false }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

API security rules found core validation and authorization signals.

Engine

Security

Evidence

{ "missing": [ "hasGraphql" ], "hasGraphql": false, "openApiFiles": [], "scannedFiles": 110, "hasJwtValidation": true, "hasInputValidation": true, "hasObjectAuthorization": true }

Recommendation

Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No .git directory found, so historical secret scanning could not run.

Engine

Security

Evidence

{}

Recommendation

Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No Dockerfile was found, so container security checks could not run.

Engine

Infrastructure

Evidence

{ "dockerfiles": [] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Fallback IaC scan found no obvious infrastructure risks.

Engine

Infrastructure

Evidence

{ "helmFiles": [], "composeFiles": [], "scannedFiles": 1, "riskyPatterns": [ { "name": "Privileged containers", "count": 0 }, { "name": "Host networking", "count": 0 }, { "name": "Latest image tags", "count": 0 }, { "name": "Public ingress CIDR", "count": 0 }, { "name": "Plaintext secret resources", "count": 0 } ], "terraformFiles": [], "kubernetesFiles": [] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No GitHub Actions, Azure DevOps, Jenkins, or GitLab CI definitions were found.

Engine

Infrastructure

Evidence

{}

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Static network readiness scan found no obvious network risks.

Engine

Infrastructure

Evidence

{ "note": "Runtime Nmap or SSL analysis requires an explicit authorized target.", "weakTls": false, "openPorts": [], "hasDnsConfig": true, "scannedFiles": [ "pnpm-lock.yaml" ], "publicExposure": false, "hasReverseProxy": false, "hasCertificateFiles": false }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Architecture scan found organized repository structure and no obvious layer violations.

Engine

Architecture

Evidence

{ "dddSignals": [], "scannedFiles": 104, "topLevelDirs": [ "app", "components", "hooks", "lib", "public", "services", "store", "styles", "types" ], "layerViolations": [], "microserviceSignals": [], "cleanArchitectureSignals": [ "application" ] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Frontend scan found exposed env, public secret, or dangerous DOM API risks.

Engine

Architecture

Evidence

{ "hasCsp": false, "envFiles": [], "backendUrls": 0, "scannedFiles": 95, "debugEndpoints": 0, "exposedEnvFiles": [], "dangerousDomApis": 1, "publicSecretNames": 0, "sourceMapsEnabled": false }

Recommendation

Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Backend scan found missing or undiscovered security controls.

Engine

Architecture

Evidence

{ "missing": [ "hasMiddleware", "hasAuthentication", "hasAuthorization", "hasRateLimiting" ], "hasLogging": true, "scannedFiles": 5, "hasMiddleware": false, "hasValidation": true, "hasRateLimiting": false, "hasAuthorization": false, "hasAuthentication": false, "hasExceptionHandling": true }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Data layer scan found missing ORM, pooling, or encryption signals.

Engine

Architecture

Evidence

{ "hasOrm": false, "hasPooling": false, "scannedFiles": 106, "hasEncryption": true, "databaseExposure": 0, "rawSqlConstruction": 0 }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No AWS, Azure, or GCP architecture artifacts were found.

Engine

Architecture

Evidence

{}

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline