Technical Engineering Report

Build failed with compilation or runtime build errors.

Engine

Quality

Evidence

{ "output": "spawn pnpm ENOENT", "runner": "pnpm", "command": "pnpm run build", "aiDiagnosis": { "reason": "openai/gpt-oss-120b: fetch failed | google/gemma-4-31B-it: fetch failed | deepseek-ai/DeepSeek-R1-Distill-Qwen-32B: fetch failed", "available": false, "modelsAttempted": [ "openai/gpt-oss-120b", "google/gemma-4-31B-it", "deepseek-ai/DeepSeek-R1-Distill-Qwen-32B" ] }, "runtimeDependencyInstall": { "output": "spawn pnpm ENOENT", "command": "pnpm install --ignore-scripts --no-frozen-lockfile", "attempted": true, "installed": false, "missingTool": true } }

Recommendation

Fix build failures before production release and add the build command to CI gates.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Lint script failed. TypeScript compiler reported errors. Fallback static scan found elevated smell, any-type, or duplicate-symbol counts.

Engine

Quality

Evidence

{ "lint": "spawn pnpm ENOENT", "staticScan": { "scannedFiles": 105, "codeSmellCount": 13, "unsafeAnyCount": 65, "duplicatedSymbolCount": 126 }, "typescript": "npm error code ENOENT\nnpm error syscall mkdir\nnpm error path /home/sbx_user1051\nnpm error errno ENOENT\nnpm error enoent Invalid response body while trying to fetch https://registry.npmjs.org/tsc: ENOENT: no such file or directory, mkdir '/home/sbx_user1051'\nnpm error enoent This is related to npm not being able to find a file.\nnpm error enoent\nnpm error Log files were not written due to an error writing to the directory: /home/sbx_user1051/.npm/_logs\nnpm error You can rerun the command with `--loglevel=verbose` to see the logs in your terminal" }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No runnable test script was found for Jest, Vitest, Playwright, Cypress, or coverage.

Engine

Quality

Evidence

{ "availableScripts": [ "build", "dev", "lint", "start" ] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Fallback SAST scan found high-risk code patterns.

Engine

Security

Evidence

{ "findings": [ { "name": "Unsafe eval", "count": 0, "severity": "high" }, { "name": "Command execution", "count": 0, "severity": "high" }, { "name": "SQL string construction", "count": 22, "severity": "high" }, { "name": "Weak crypto", "count": 0, "severity": "medium" }, { "name": "Prototype pollution sink", "count": 0, "severity": "medium" }, { "name": "Path traversal risk", "count": 0, "severity": "medium" } ], "scannedFiles": 103 }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Fallback secret scan did not find known secret patterns.

Engine

Security

Evidence

{ "envFiles": [], "findings": [ { "name": "AWS access key", "count": 0 }, { "name": "OpenAI key", "count": 0 }, { "name": "Private key", "count": 0 }, { "name": "JWT", "count": 0 }, { "name": "Generic secret assignment", "count": 0 } ], "scannedFiles": 109, "includeGitHistory": false }

Recommendation

Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

pnpm audit could not be started on this machine.

Engine

Security

Evidence

{ "tool": "pnpm audit", "output": "spawn pnpm ENOENT" }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Custom web security rules found missing or undiscovered controls.

Engine

Security

Evidence

{ "hasCsp": false, "missing": [ "hasCsp", "hasCorsConfig", "hasCsrfToken", "hasRateLimit", "hasSecureCookie" ], "hasCsrfToken": false, "hasRateLimit": false, "scannedFiles": 108, "hasCorsConfig": false, "hasAuthzChecks": true, "hasSecureCookie": false }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

API security rules found missing or undiscovered JWT, authorization, or validation controls.

Engine

Security

Evidence

{ "missing": [ "hasJwtValidation", "hasGraphql" ], "hasGraphql": false, "openApiFiles": [], "scannedFiles": 109, "hasJwtValidation": false, "hasInputValidation": true, "hasObjectAuthorization": true }

Recommendation

Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No .git directory found, so historical secret scanning could not run.

Engine

Security

Evidence

{}

Recommendation

Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No Dockerfile was found, so container security checks could not run.

Engine

Infrastructure

Evidence

{ "dockerfiles": [] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Fallback IaC scan found no obvious infrastructure risks.

Engine

Infrastructure

Evidence

{ "helmFiles": [], "composeFiles": [], "scannedFiles": 1, "riskyPatterns": [ { "name": "Privileged containers", "count": 0 }, { "name": "Host networking", "count": 0 }, { "name": "Latest image tags", "count": 0 }, { "name": "Public ingress CIDR", "count": 0 }, { "name": "Plaintext secret resources", "count": 0 } ], "terraformFiles": [], "kubernetesFiles": [] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No GitHub Actions, Azure DevOps, Jenkins, or GitLab CI definitions were found.

Engine

Infrastructure

Evidence

{}

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Static network readiness scan found no obvious network risks.

Engine

Infrastructure

Evidence

{ "note": "Runtime Nmap or SSL analysis requires an explicit authorized target.", "weakTls": false, "openPorts": [], "hasDnsConfig": false, "scannedFiles": [ "pnpm-lock.yaml" ], "publicExposure": false, "hasReverseProxy": false, "hasCertificateFiles": false }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Architecture scan found organized repository structure and no obvious layer violations.

Engine

Architecture

Evidence

{ "dddSignals": [], "scannedFiles": 103, "topLevelDirs": [ "app", "components", "hooks", "lib", "public", "services", "store", "styles", "types" ], "layerViolations": [], "microserviceSignals": [], "cleanArchitectureSignals": [] }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Frontend scan found exposed env, public secret, or dangerous DOM API risks.

Engine

Architecture

Evidence

{ "hasCsp": false, "envFiles": [], "backendUrls": 0, "scannedFiles": 95, "debugEndpoints": 0, "exposedEnvFiles": [], "dangerousDomApis": 1, "publicSecretNames": 0, "sourceMapsEnabled": false }

Recommendation

Rotate exposed credentials, remove secrets from source control, and enforce secret scanning in CI.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Backend scan found missing or undiscovered security controls.

Engine

Architecture

Evidence

{ "missing": [ "hasMiddleware", "hasAuthentication", "hasAuthorization", "hasRateLimiting" ], "hasLogging": true, "scannedFiles": 5, "hasMiddleware": false, "hasValidation": true, "hasRateLimiting": false, "hasAuthorization": false, "hasAuthentication": false, "hasExceptionHandling": true }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

Data layer scan found missing ORM, pooling, or encryption signals.

Engine

Architecture

Evidence

{ "hasOrm": false, "hasPooling": false, "scannedFiles": 105, "hasEncryption": true, "databaseExposure": 0, "rawSqlConstruction": 0 }

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline

No AWS, Azure, or GCP architecture artifacts were found.

Engine

Architecture

Evidence

{}

Recommendation

Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.

References

OWASP ASVS, CWE mapping pending, organization policy baseline